FilterSecurityInterceptor, if there is an AccessDeniedException in deciding whether to allow a given URI to be called, will never pass to the underlaying servlets (including HandlerExceptionResolver).
Your easiest solution for a custom error page for 403 errors is to override this method in FilterSecurityInterceptor with a standard redirect:
Code:
protected void sendAccessDeniedError(FilterInvocation fi,
AccessDeniedException accessDenied)
throws ServletException, IOException {
((HttpServletRequest) fi.getRequest()).getSession().setAttribute(ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY,
accessDenied);
((HttpServletResponse) fi.getResponse()).sendError(HttpServletResponse.SC_FORBIDDEN,
accessDenied.getMessage()); // 403
}