41

I want my controller to return the right HTTP response code when the user lacks permission to view a particular page.

6 Answers 6

63

You can also just throw

org.springframework.security.access.AccessDeniedException("403 returned");

This returns a 403 in the response header.

3
  • 1
    This works perfectly and should be the accepted answer because it's most flexible.
    – Heady
    Commented Oct 19, 2016 at 21:38
  • 3
    @Heady : Not really the best answer because it creates a strong dependency with Spring Security. Joe's answer, to create your own Exception, is the best IMO. I still upvoted that one since it's a decent alternative. Commented Aug 22, 2017 at 14:31
  • 9
    This returns a 500 for me.
    – heez
    Commented Jan 13, 2018 at 23:26
54

Create an Exception annotated with @ResponseStatus e.g. like this:

@ResponseStatus(HttpStatus.FORBIDDEN)
public class ForbiddenException extends RuntimeException {
}

Now just throw that Exception in your handler method and the response will have status 403.

1
  • See the answer from @Largos below if you are using Spring 5+
    – wlnirvana
    Commented Jul 30, 2022 at 14:19
13

Quickie

If you are using plain JSP views (as is most common), then simply add

<% response.setStatus( 403 ); %>

somewhere in your view file. At the top is a nice place.

Detail

In MVC, i would always set this in the view, and in most cases with Spring-MVC, use the SimpleMappingExceptionResolver to present the correct view in response to a thrown runtime Exception.

For example: create and throw a PermissionDeniedException in your controller or service layer and have the exception resolver point to a view file permissionDenied.jsp. This view file sets the 403 status and shows the user an appropriate message.

In your Spring bean XML file:

<bean id="exceptionResolver"
      class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
  <property name="exceptionMappings">
    <props>
      <prop key="PermissionDeniedException">          
        rescues/permissionDenied
      </prop>
      ... set other exception/view mappings as <prop>s here ...
    </props>
  </property>
  <property name="defaultErrorView" value="rescues/general" />
</bean>

<bean id="viewResolver"
      class="org.springframework.web.servlet.view.InternalResourceViewResolver">
  <property name="viewClass" value="org.springframework.web.servlet.view.JstlView" />
  <property name="prefix" value="/WEB-INF/views/" />
  <property name="suffix" value=".jsp" />
</bean>

If you need to implement a user login mechanism, take a look at Spring Security (formerly Acegi Security).

1
  • Why is the response.setStatus necessary? Following the response (in Tomcat), there seems to be some strage evolution of the http response code of the response - it is first 200 (default), then moves to 404 (for the sake of the argument) when the Spring DispatcherServlet process the handler exception, then, the view is rendered and the code is set to 500 (which is strange), and then, the setStatus does indeed fix the issue by reverting the code of the response back to 404.
    – Eugen
    Commented Aug 8, 2011 at 14:20
13

Using an ExceptionResolver is a great way to go, but if you just want this to be view-independent, you could certainly make a call to response.sendError(HttpServletResponse.SC_FORBIDDEN, "AdditionalInformationIfAvailable"); in your Controller.

13

Use ResponseStatusException :

@GetMapping("/demo")
public String demo(){
  if (forbidden){
    throw new ResponseStatusException(HttpStatus.FORBIDDEN); 
  }
}
7

Use this: response.setStatus(403).

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.