Method Security and @RestControllerAdvice

An AccessDeniedException from @PreAuthorize is thrown inside your controller or service, so Spring MVC sees it before the security filters do. If you have a catch-all handler, it swallows the exception and the user gets 500 instead of 403:

@RestControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler(Exception.class)          // catches AccessDeniedException too!
    public ResponseEntity<ApiError> other(Exception ex, HttpServletRequest req) {
        return ResponseEntity.status(500)
                .body(new ApiError(500, "Internal Server Error", "Something went wrong", req.getRequestURI()));
    }
}

curl -i -X DELETE localhost:8080/api/products/7 -H "Authorization: Bearer $ASHA_TOKEN"

HTTP/1.1 500 Internal Server Error
{"status":500,"error":"Internal Server Error","message":"Something went wrong","path":"/api/products/7"}

@RestControllerAdvice
public class GlobalExceptionHandler {

    // let Spring Security's ExceptionTranslationFilter handle these,
    // so 401/403 JSON comes from the entry point and denied handler
    @ExceptionHandler({AccessDeniedException.class, AuthenticationException.class})
    public void security(RuntimeException ex) {
        throw ex;
    }

    @ExceptionHandler(OrderNotFoundException.class)
    public ResponseEntity<ApiError> notFound(OrderNotFoundException ex, HttpServletRequest req) {
        return ResponseEntity.status(404).body(new ApiError(404, "Not Found", ex.getMessage(), req.getRequestURI()));
    }

    @ExceptionHandler(Exception.class)
    public ResponseEntity<ApiError> other(Exception ex, HttpServletRequest req) {
        return ResponseEntity.status(500)
                .body(new ApiError(500, "Internal Server Error", "Something went wrong", req.getRequestURI()));
    }
}

curl -i -X DELETE localhost:8080/api/products/7 -H "Authorization: Bearer $ASHA_TOKEN"

HTTP/1.1 403 Forbidden
{"status":403,"error":"Forbidden","message":"You do not have permission to access this resource","path":"/api/products/7"}