<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">

        <property name="exceptionMappings">

            <props>

                <prop key="org.apache.shiro.authz.UnauthorizedException">/403</prop>

            </props>

        </property>

    </bean>

    private void applyUnauthorizedUrlIfNecessary(Filter filter) {

        String unauthorizedUrl = getUnauthorizedUrl();

        if (StringUtils.hasText(unauthorizedUrl) && (filter instanceof AuthorizationFilter)) {

            AuthorizationFilter authzFilter = (AuthorizationFilter) filter;

            //only apply the unauthorizedUrl if they haven't explicitly configured one already:

            String existingUnauthorizedUrl = authzFilter.getUnauthorizedUrl();

            if (existingUnauthorizedUrl == null) {

                authzFilter.setUnauthorizedUrl(unauthorizedUrl);

            }

        }

    }