In our project we where using spring-security 4.1.3 and the behavior was as follows : when the user is a remember me and want to access a page that requires a full authentication, a redirection will be made to a custom page (not login) using AccessDeniedHandler to enter a password confirmation from it
Once we upgraded to release 4.2.20 we are facing a problem with the remember me feature the application behaves as follow : when the user is a remember me and want to access a page that requires a full authentication, a redirection will be made to the login page
When I checked the source code from spring-security I found that a change was made in the mentioned version
in the handleAccessDeniedException method a check of isRememberMe was added that it's causing the problem
I am wondering if this is the normal behavior for ExceptionTranslationFilter.java or I must added some customization in my code to make it works as before, if so how ? Thank you in advance.
This situation was mentioned in the original bug of spring-security https://github.com/spring-projects/spring-security/issues/2427