title: 'Access Denied' page Redirect are not working
body: <ol>
  <li><p>My web project is based on Spring 3.2.5.RELEASE, JSF 2 and PrimeFaces 6. I'm using <code>@PreAuthorize</code> annotation on class level at service layer as below:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Service("packageService")
  @Transactional(readOnly = true)
  @PreAuthorize("hasAnyRole('befit')")
  public class PackageServiceImpl implements PackageService {
  }
  </code></pre></li>
  <li><p>At JSF managed bean level, I don't have any <code>@PreAuthorize</code>. On <code>@PostConstruct</code> method, I have called couple methods from service layer which requires authorization.</p></li>
  <li><p>At XHTML page, I use EL to get data from managed bean. </p></li>
  <li><p>Security configuration as:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;sec:http auto-config="true" use-expressions="true"&gt;
  
          &lt;sec:access-denied-handler error-page="/access.xhtml"/&gt;
  
          &lt;!-- Page level Spring Security : Intercept access to resources in /faces/** --&gt;
          &lt;sec:intercept-url pattern="/faces/admin/*"
              access="hasAnyRole('befit','admin')" /&gt;
  
          &lt;sec:intercept-url pattern="/faces/befit/*"
              access="hasAnyRole('befit')" /&gt;
  
          &lt;sec:intercept-url pattern="/faces/online/*"
              access="isAuthenticated()" /&gt;   
  </code></pre></li>
  <li><p>Functionalities are working fine. If an user logged in 'less' role and try to access pages required 'more' roles, I do see 'Access Denied' exception from <code>@PostConstruct</code> method. But it doesn't navigate to <code>access.xhtml</code> page.</p></li>
  </ol>
  
  <p>Note: I have tried using a bean to handle <code>AccessDeniedException</code> as </p>
  
  <pre><code>@Override
  public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
  
      response.sendRedirect(response.encodeRedirectURL(request.getContextPath() + accessDeniedUrl));
      request.getSession().setAttribute("message", "You are not authorized to access this resource.");
  }
  </code></pre>
  
  <p>And I got the exception as below</p>
  
  <blockquote>
    <p>cannot call sendredirect after the response has been committed servlet</p>
  </blockquote>
  
  <p>Could you please advice what I miss?</p>
  
  <p>Note: Updated with StackTrace</p>
  
  <pre><code>Oct 12, 2016 4:50:00 PM com.sun.faces.application.view.FaceletViewHandlingStrategy handleRenderException
  SEVERE: Error Rendering View[/faces/befit/corporate/corporate_manage.xhtml]
  com.sun.faces.mgbean.ManagedBeanCreationException: An error occurred performing resource injection on managed bean corporateManageMBean
      at com.sun.faces.mgbean.BeanBuilder.invokePostConstruct(BeanBuilder.java:227)
      at com.sun.faces.mgbean.BeanBuilder.build(BeanBuilder.java:103)
      at com.sun.faces.mgbean.BeanManager.createAndPush(BeanManager.java:409)
      at com.sun.faces.mgbean.BeanManager.create(BeanManager.java:269)
      at com.sun.faces.el.ManagedBeanELResolver.resolveBean(ManagedBeanELResolver.java:257)
      at com.sun.faces.el.ManagedBeanELResolver.getValue(ManagedBeanELResolver.java:117)
      at com.sun.faces.el.DemuxCompositeELResolver._getValue(DemuxCompositeELResolver.java:176)
      at com.sun.faces.el.DemuxCompositeELResolver.getValue(DemuxCompositeELResolver.java:203)
      at org.apache.el.parser.AstIdentifier.getValue(AstIdentifier.java:71)
      at org.apache.el.parser.AstValue.getValue(AstValue.java:161)
      at org.apache.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:184)
      at com.sun.faces.facelets.el.TagValueExpression.getValue(TagValueExpression.java:109)
      at javax.faces.component.ComponentStateHelper.eval(ComponentStateHelper.java:194)
      at javax.faces.component.ComponentStateHelper.eval(ComponentStateHelper.java:182)
      at javax.faces.component.UIOutput.getValue(UIOutput.java:174)
      at javax.faces.component.UIInput.getValue(UIInput.java:291)
      at org.primefaces.util.ComponentUtils.getValueToRender(ComponentUtils.java:94)
      at org.primefaces.util.ComponentUtils.getValueToRender(ComponentUtils.java:58)
      at org.primefaces.component.inputtext.InputTextRenderer.encodeMarkup(InputTextRenderer.java:71)
      at org.primefaces.component.inputtext.InputTextRenderer.encodeEnd(InputTextRenderer.java:52)
      at javax.faces.component.UIComponentBase.encodeEnd(UIComponentBase.java:920)
      at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1863)
      at javax.faces.render.Renderer.encodeChildren(Renderer.java:176)
      at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:890)
      at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1856)
      at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1859)
      at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1859)
      at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(FaceletViewHandlingStrategy.java:458)
      at com.sun.faces.application.view.MultiViewHandler.renderView(MultiViewHandler.java:134)
      at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:120)
      at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
      at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:219)
      at javax.faces.webapp.FacesServlet.service(FacesServlet.java:659)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:118)
      at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:154)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:150)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:199)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
  
      at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1083)
      at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:640)
              at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:96)
      at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:260)
      at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:94)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
      at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:631)
      at com.itservicesdepot.befit.master.service.impl.CorporateServiceImpl$$EnhancerByCGLIB$$64cca414.fetchAll(&lt;generated&gt;)
      at com.itservicesdepot.befit.master.controller.managedBean.CorporateManageMBean.init(CorporateManageMBean.java:62)
      ... 90 more
  
  Oct 12, 2016 4:50:00 PM com.sun.faces.context.ExceptionHandlerImpl throwIt
  INFO: Exception when handling error trying to reset the response.
  com.sun.faces.mgbean.ManagedBeanCreationException: An error occurred performing resource injection on managed bean corporateManageMBean
      at com.sun.faces.mgbean.BeanBuilder.invokePostConstruct(BeanBuilder.java:227)
      at com.sun.faces.mgbean.BeanBuilder.build(BeanBuilder.java:103)
      at com.sun.faces.mgbean.BeanManager.createAndPush(BeanManager.java:409)
      at com.sun.faces.mgbean.BeanManager.create(BeanManager.java:269)
      at com.sun.faces.el.ManagedBeanELResolver.resolveBean(ManagedBeanELResolver.java:257)
      at com.sun.faces.el.ManagedBeanELResolver.getValue(ManagedBeanELResolver.java:117)
      at com.sun.faces.el.DemuxCompositeELResolver._getValue(DemuxCompositeELResolver.java:176)
      at com.sun.faces.el.DemuxCompositeELResolver.getValue(DemuxCompositeELResolver.java:203)
      at org.apache.el.parser.AstIdentifier.getValue(AstIdentifier.java:71)
      at org.apache.el.parser.AstValue.getValue(AstValue.java:161)
      at org.apache.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:184)
      at com.sun.faces.facelets.el.TagValueExpression.getValue(TagValueExpression.java:109)
      at javax.faces.component.ComponentStateHelper.eval(ComponentStateHelper.java:194)
      at javax.faces.component.ComponentStateHelper.eval(ComponentStateHelper.java:182)
      at javax.faces.component.UIOutput.getValue(UIOutput.java:174)
      at javax.faces.component.UIInput.getValue(UIInput.java:291)
      at org.primefaces.util.ComponentUtils.getValueToRender(ComponentUtils.java:94)
      at org.primefaces.util.ComponentUtils.getValueToRender(ComponentUtils.java:58)
      at org.primefaces.component.inputtext.InputTextRenderer.encodeMarkup(InputTextRenderer.java:71)
      at org.primefaces.component.inputtext.InputTextRenderer.encodeEnd(InputTextRenderer.java:52)
      at javax.faces.component.UIComponentBase.encodeEnd(UIComponentBase.java:920)
      at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1863)
      at javax.faces.render.Renderer.encodeChildren(Renderer.java:176)
      at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:890)
      at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1856)
      at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1859)
      at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1859)
      at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(FaceletViewHandlingStrategy.java:458)
      at com.sun.faces.application.view.MultiViewHandler.renderView(MultiViewHandler.java:134)
      at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:120)
      at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
      at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:219)
      at javax.faces.webapp.FacesServlet.service(FacesServlet.java:659)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
      at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:118)
      at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:154)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:150)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:199)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
      at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
      at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
      at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
      at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:442)
      at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1083)
      at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:640)
      at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      at java.lang.Thread.run(Thread.java:745)
  Caused by: com.sun.faces.spi.InjectionProviderException
      at com.sun.faces.vendor.WebContainerInjectionProvider.invokeAnnotatedMethod(WebContainerInjectionProvider.java:115)
      at com.sun.faces.vendor.WebContainerInjectionProvider.invokePostConstruct(WebContainerInjectionProvider.java:95)
      at com.sun.faces.mgbean.BeanBuilder.invokePostConstruct(BeanBuilder.java:221)
      ... 83 more
  Caused by: java.lang.reflect.InvocationTargetException
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at com.sun.faces.vendor.WebContainerInjectionProvider.invokeAnnotatedMethod(WebContainerInjectionProvider.java:113)
      ... 85 more
  Caused by: org.springframework.security.access.AccessDeniedException: Access is denied
      at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:83)
      at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:206)
      at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:60)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
      at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:96)
      at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:260)
      at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:94)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
      at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:631)
      at com.itservicesdepot.befit.master.service.impl.CorporateServiceImpl$$EnhancerByCGLIB$$64cca414.fetchAll(&lt;generated&gt;)
      at com.itservicesdepot.befit.master.controller.managedBean.CorporateManageMBean.init(CorporateManageMBean.java:62)
      ... 90 more
  </code></pre>
  
  <p>Updated with Spring Security</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:sec="http://www.springframework.org/schema/security"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:tx="http://www.springframework.org/schema/tx"
      xsi:schemaLocation="
          http://www.springframework.org/schema/tx 
          http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
          http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
          http://www.springframework.org/schema/context 
          http://www.springframework.org/schema/context/spring-context-3.0.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
          &lt;!-- Enable method level Spring Security by annotations --&gt;
          &lt;sec:global-method-security pre-post-annotations="enabled" /&gt;
          &lt;sec:http auto-config="true" use-expressions="true"&gt;
  
              &lt;sec:access-denied-handler ref="accessDeniedHandler"/&gt;
  
              &lt;!-- Page level Spring Security : Intercept access to resources in /faces/** --&gt;
              &lt;sec:intercept-url pattern="/faces/editor/*"
                  access="hasAnyRole('editor,befit,admin')" /&gt;
  
              &lt;sec:intercept-url pattern="/faces/admin/*"
                  access="hasAnyRole('befit,admin')" /&gt;
  
              &lt;sec:intercept-url pattern="/faces/befit/*"
                  access="hasAnyRole('befit')" /&gt;
  
              &lt;sec:intercept-url pattern="/faces/online/*"
                  access="isAuthenticated()" /&gt;
  
              &lt;!-- Page level Spring Security : Intercept access to resources in /WEB-INF/templates/** --&gt;
              &lt;sec:intercept-url pattern="/WEB-INF/templates/**"
                  access="permitAll" /&gt;
  
              &lt;!-- Page level Spring Security : Enable Primefaces --&gt;
              &lt;sec:intercept-url pattern="/javax.faces.resource/**"
                  access="permitAll" /&gt;
  
              &lt;!-- Define login page for Spring Security --&gt;
              &lt;sec:form-login login-page="/login.xhtml" /&gt;
  
              &lt;!-- Define logout properties for Spring Security --&gt;
              &lt;sec:logout invalidate-session="true" delete-cookies="true"
                  logout-success-url="/landing.xhtml"&gt;&lt;/sec:logout&gt;
          &lt;/sec:http&gt;
  
          &lt;!-- Set customUserDetailsService class as the authentication Manager for 
              Spring Security --&gt;
          &lt;sec:authentication-manager alias="authenticationManager"&gt;
              &lt;sec:authentication-provider
                  user-service-ref="authenticationServiceImpl"&gt;
                  &lt;sec:password-encoder hash="plaintext"&gt;&lt;/sec:password-encoder&gt;
              &lt;/sec:authentication-provider&gt;
          &lt;/sec:authentication-manager&gt;
  
          &lt;!-- Inject authentication Manager to masterSecurityBean --&gt;
          &lt;bean id="loginMBean" name="loginMBean" class="com.itservicesdepot.befit.master.controller.managedBean.LoginMBean" scope="request"&gt;
              &lt;property name="authenticationManager" ref="authenticationManager"&gt;&lt;/property&gt;
          &lt;/bean&gt;
  
          &lt;bean id="accessDeniedHandler" class="com.itservicesdepot.befit.master.controller.validator.MasterAccessDeniedHandler"&gt;
              &lt;property name="errorPage" value="/access.xhtml" /&gt;
           &lt;/bean&gt;
  &lt;/beans&gt;
  
  public class MasterAccessDeniedHandler extends org.springframework.security.web.access.AccessDeniedHandlerImpl {
      private final Logger logger = LoggerFactory.getLogger(MasterAccessDeniedHandler.class);
  
  
  
   @Override
      public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
          this.logger.info("redirect ");
         super.handle(request, response, accessDeniedException);
      }
  }
  </code></pre>
  
  <p>Updated with CorporateManageMBean</p>
  
  <pre><code>    @PostConstruct
          public void init() {
              String id = this.getParameterByName(AppConstant.ID);
  
              if (StringUtils.isNotEmpty(id)) {
                  this.corporate = this.corporateService.fetchById(Long.valueOf(id));
                  this.header = this.getResourceByName("corporate.profile.label.modify.header");
              }
              else {
                  this.corporate = new CorporateEntity();
                  header = this.getResourceByName("corporate.profile.label.add.header");
              }
  
  // this call to corporateService will throw AccessDenied
              this.corporates = this.corporateService.fetchAll();
              this.packages = this.packageService.fetchAll();
  </code></pre>
  
  <p>The CorporateService as below</p>
  
  <pre><code>@Service("corporateService")
  @Transactional(readOnly = true)
  @PreAuthorize("hasAnyRole('befit')")
  public class CorporateServiceImpl implements CorporateService {
  
  @Override
      public List&lt;CorporateEntity&gt; fetchAll() {
          return this.corporateDAO.fetchAll();
      }
  }
  </code></pre>
  
  <p>Updated with web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
      version="2.5"&gt;
  
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;landing.xhtml&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  
      &lt;!-- All parameters --&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;primefaces.THEME&lt;/param-name&gt;
          &lt;param-value&gt;ultima-indigo&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;primefaces.FONT_AWESOME&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;log4jConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/log4j.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/spring/root-context.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;facelets.DEVELOPMENT&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;!-- All defined Listeners --&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.util.Log4jConfigListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;!-- All defined Servlets --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;SpringMVC&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;/WEB-INF/spring/root-context.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;!-- Spring Security --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;dispatcher&gt;FORWARD&lt;/dispatcher&gt;
          &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
      &lt;/filter-mapping&gt;
  
      &lt;!-- Mapping --&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.xhtml&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;SpringMVC&lt;/servlet-name&gt;
          &lt;url-pattern&gt;*.action&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
  &lt;/web-app&gt;
  </code></pre>