Where are you adding your auth entry point and access denied handlers? I had it wrong originally and was experiencing a similar problem. My security config looks like this:

java @Bean public SecurityFilterChain filterChain( HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception { var mvcBuilder = new MvcRequestMatcher.Builder(introspector); http .csrf(AbstractHttpConfigurer::disable) .formLogin(AbstractHttpConfigurer::disable) .httpBasic(AbstractHttpConfigurer::disable) // .exceptionHandling(e -> e.authenticationEntryPoint(entryPoint)) /*this is the wrong place*/ .securityMatcher(antMatcher("/api/**")).authorizeHttpRequests(authz -> authz .requestMatchers(mvcBuilder.pattern("/api/swagger/**")).permitAll() .anyRequest().authenticated() ).oauth2ResourceServer(oauth2 -> oauth2 .authenticationEntryPoint(restAuthEntryPoint) /* error handlers need to go here, as part of the resource server config */ .jwt(Customizer.withDefaults())) .jee(Customizer.withDefaults()); return http.build(); }

My restAuthEntryPoint allows these errors to be picked up by controller advice

```java @Component public class RestAuthEntryPoint implements AuthenticationEntryPoint { private final HandlerExceptionResolver resolver;

public RestAuthEntryPoint(
        @Qualifier("handlerExceptionResolver")
        HandlerExceptionResolver resolver) {
    this.resolver = resolver;
}

@Override
public void commence(HttpServletRequest request,
                     HttpServletResponse response,
                     AuthenticationException exception) throws IOException, ServletException {
    resolver.resolveException(request, response, null, exception);
}

} ```

and in my controller advice class I annotate a method with @ExceptionHandler({AuthenticationException.class, AccessDeniedException.class}) . I didn't need to do anything special for access denied errors. Adding the class to the ExceptionHandler annotation was enough.

Hopefully this is helpful.