Add @AuthorizationDeniedHandler for Method Authorization Denied Handling

Issue gh-14601

core/src/main/java/org/springframework/security/access/prepost/PostAuthorize.java

@@ -23,9 +23,6 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import org.springframework.security.authorization.method.MethodAuthorizationDeniedPostProcessor;
-import org.springframework.security.authorization.method.ThrowingMethodAuthorizationDeniedPostProcessor;
-
 /**
  * Annotation for specifying a method access-control expression which will be evaluated
  * after a method has been invoked.
@@ -45,10 +42,4 @@ public @interface PostAuthorize {
 	 */
 	String value();
 
-	/**
-	 * @return the {@link MethodAuthorizationDeniedPostProcessor} class used to
-	 * post-process access denied
-	 */
-	Class<? extends MethodAuthorizationDeniedPostProcessor> postProcessorClass() default ThrowingMethodAuthorizationDeniedPostProcessor.class;
-
 }

core/src/main/java/org/springframework/security/access/prepost/PreAuthorize.java

@@ -23,9 +23,6 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import org.springframework.security.authorization.method.MethodAuthorizationDeniedHandler;
-import org.springframework.security.authorization.method.ThrowingMethodAuthorizationDeniedHandler;
-
 /**
  * Annotation for specifying a method access-control expression which will be evaluated to
  * decide whether a method invocation is allowed or not.
@@ -45,10 +42,4 @@ public @interface PreAuthorize {
 	 */
 	String value();
 
-	/**
-	 * @return the {@link MethodAuthorizationDeniedHandler} class used to handle access
-	 * denied
-	 */
-	Class<? extends MethodAuthorizationDeniedHandler> handlerClass() default ThrowingMethodAuthorizationDeniedHandler.class;
-
 }

core/src/main/java/org/springframework/security/authorization/method/AuthorizationDeniedHandler.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright 2002-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.authorization.method;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Inherited;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * Annotation for specifying handling behavior when an authorization denied happens in
+ * method security
+ *
+ * @author Marcus da Coregio
+ * @since 6.3
+ * @see org.springframework.security.access.prepost.PreAuthorize
+ * @see org.springframework.security.access.prepost.PostAuthorize
+ */
+@Target({ ElementType.METHOD, ElementType.TYPE })
+@Retention(RetentionPolicy.RUNTIME)
+@Inherited
+@Documented
+public @interface AuthorizationDeniedHandler {
+
+	/**
+	 * The {@link MethodAuthorizationDeniedHandler} used to handle denied authorizations
+	 * from {@link org.springframework.security.access.prepost.PreAuthorize}
+	 * @return
+	 */
+	Class<? extends MethodAuthorizationDeniedHandler> handlerClass() default ThrowingMethodAuthorizationDeniedHandler.class;
+
+	/**
+	 * The {@link MethodAuthorizationDeniedPostProcessor} used to post process denied
+	 * authorizations from
+	 * {@link org.springframework.security.access.prepost.PostAuthorize}
+	 * @return
+	 */
+	Class<? extends MethodAuthorizationDeniedPostProcessor> postProcessorClass() default ThrowingMethodAuthorizationDeniedPostProcessor.class;
+
+}

core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeExpressionAttributeRegistry.java

@@ -55,11 +55,24 @@ final class PostAuthorizeExpressionAttributeRegistry extends AbstractExpressionA
 			return ExpressionAttribute.NULL_ATTRIBUTE;
 		}
 		Expression expression = getExpressionHandler().getExpressionParser().parseExpression(postAuthorize.value());
-		MethodAuthorizationDeniedPostProcessor postProcessor = this.postProcessorResolver
-			.apply(postAuthorize.postProcessorClass());
+		MethodAuthorizationDeniedPostProcessor postProcessor = resolvePostProcessor(method, targetClass);
 		return new PostAuthorizeExpressionAttribute(expression, postProcessor);
 	}
 
+	private MethodAuthorizationDeniedPostProcessor resolvePostProcessor(Method method, Class<?> targetClass) {
+		Function<AnnotatedElement, AuthorizationDeniedHandler> lookup = AuthorizationAnnotationUtils
+			.withDefaults(AuthorizationDeniedHandler.class);
+		AuthorizationDeniedHandler deniedHandler = lookup.apply(method);
+		if (deniedHandler != null) {
+			return this.postProcessorResolver.apply(deniedHandler.postProcessorClass());
+		}
+		deniedHandler = lookup.apply(targetClass(method, targetClass));
+		if (deniedHandler != null) {
+			return this.postProcessorResolver.apply(deniedHandler.postProcessorClass());
+		}
+		return this.defaultPostProcessor;
+	}
+
 	private PostAuthorize findPostAuthorizeAnnotation(Method method, Class<?> targetClass) {
 		Function<AnnotatedElement, PostAuthorize> lookup = findUniqueAnnotation(PostAuthorize.class);
 		PostAuthorize postAuthorize = lookup.apply(method);

core/src/main/java/org/springframework/security/authorization/method/PreAuthorizeExpressionAttributeRegistry.java

@@ -55,10 +55,24 @@ final class PreAuthorizeExpressionAttributeRegistry extends AbstractExpressionAt
 			return ExpressionAttribute.NULL_ATTRIBUTE;
 		}
 		Expression expression = getExpressionHandler().getExpressionParser().parseExpression(preAuthorize.value());
-		MethodAuthorizationDeniedHandler handler = this.handlerResolver.apply(preAuthorize.handlerClass());
+		MethodAuthorizationDeniedHandler handler = resolveHandler(method, targetClass);
 		return new PreAuthorizeExpressionAttribute(expression, handler);
 	}
 
+	private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class<?> targetClass) {
+		Function<AnnotatedElement, AuthorizationDeniedHandler> lookup = AuthorizationAnnotationUtils
+			.withDefaults(AuthorizationDeniedHandler.class);
+		AuthorizationDeniedHandler deniedHandler = lookup.apply(method);
+		if (deniedHandler != null) {
+			return this.handlerResolver.apply(deniedHandler.handlerClass());
+		}
+		deniedHandler = lookup.apply(targetClass(method, targetClass));
+		if (deniedHandler != null) {
+			return this.handlerResolver.apply(deniedHandler.handlerClass());
+		}
+		return this.defaultHandler;
+	}
+
 	private PreAuthorize findPreAuthorizeAnnotation(Method method, Class<?> targetClass) {
 		Function<AnnotatedElement, PreAuthorize> lookup = findUniqueAnnotation(PreAuthorize.class);
 		PreAuthorize preAuthorize = lookup.apply(method);