AccessDeniedHandler

@Component
public class JsonAccessDeniedHandler implements AccessDeniedHandler {

    private final ObjectMapper mapper;

    public JsonAccessDeniedHandler(ObjectMapper mapper) {
        this.mapper = mapper;
    }

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException ex) throws IOException {
        String message = ex instanceof CsrfException
                ? "Invalid or missing CSRF token"
                : "You do not have permission to access this resource";
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        mapper.writeValue(response.getOutputStream(),
                new ApiError(403, "Forbidden", message, request.getRequestURI()));
    }
}

@Bean
SecurityFilterChain api(HttpSecurity http,
                        JsonAuthenticationEntryPoint entryPoint,
                        JsonAccessDeniedHandler deniedHandler) throws Exception {
    http
        // ... cors, csrf, session, authorizeHttpRequests, JWT filter as before
        .exceptionHandling(ex -> ex
            .authenticationEntryPoint(entryPoint)
            .accessDeniedHandler(deniedHandler));
    return http.build();
}

curl -i localhost:8080/api/admin/users -H "Authorization: Bearer $ASHA_TOKEN"

HTTP/1.1 403 Forbidden
Content-Type: application/json
{"status":403,"error":"Forbidden","message":"You do not have permission to access this resource","path":"/api/admin/users"}