Spring ControllerAdvice and authentication/authorization exception handling
<p>In my Spring Boot appliation I have a following web security config:</p>

<pre><code>@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        // @formatter:off   
        http
            .headers().frameOptions().disable()
            .and()
                .antMatcher("/**").authorizeRequests()
                .antMatchers("/actuator/health").permitAll()
                .antMatchers("/actuator/**").hasAuthority(Authority.Type.ROLE_ADMIN.getName())
                .antMatchers("/login/**").permitAll()
                .anyRequest().authenticated()
            .and()
                .formLogin()
                    .loginPage("/login")
                    .loginProcessingUrl("/login")
                    .failureUrl("/login?error").permitAll()
            .and()
                .logout()
                    .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                    .logoutSuccessUrl("/login?logout")
            .and()
                .csrf().csrfTokenRepository(csrfTokenRepository()).ignoringAntMatchers("/login/**")
            .and()
                .addFilterBefore(corsFilter, ChannelProcessingFilter.class)
                .addFilterAfter(new CsrfTokenResponseHeaderBindingFilter(), CsrfFilter.class)
                .addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class)
                .exceptionHandling().authenticationEntryPoint(new Http403ForbiddenEntryPoint());
        // @formatter:on
    }

....

}
</code></pre>

<p>and <code>ControllerAdvice</code>:</p>

<pre><code>@ControllerAdvice
public class GlobalControllerExceptionHandler  {

    private static final String ERROR = "error";

    @ExceptionHandler(value = Exception.class)
    @ResponseStatus(value = HttpStatus.INTERNAL_SERVER_ERROR)
    @ResponseBody
    public Map&lt;String, ErrorResponse&gt; handleException(Exception exception) {
        return createResponseError(exception);
    }

    private Map&lt;String, ErrorResponse&gt; createResponseError(Exception exception) {
        final Map&lt;String, ErrorResponse&gt; responseError = new HashMap&lt;String, ErrorResponse&gt;();
        responseError.put(ERROR, new ErrorResponse(exception.getMessage()));
        return responseError;
    }

}
</code></pre>

<p>Right now, when I'm trying to access my secure API urls by anonymous user, I'm receiving a following error:</p>

<pre><code>Whitelabel Error Page

This application has no explicit mapping for /error, so you are seeing this as a fallback.
Fri May 06 22:59:05 EEST 2016
There was an unexpected error (type=Forbidden, status=403).
Access Denied
</code></pre>

<p>Instead of this page, I need to handle such kind of errors in my <code>ControllerAdvice</code> (in order to return JSON error response) which is working fine for all other exceptions but only for authenticated users.</p>

<p>How to handle this Authentication/Authorization error by my <code>GlobalControllerExceptionHandler</code>?</p>