Using Spring Security 3.6.3, setting up SecurityFilterChain as follows:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
            // removed default for readability: logout, anonymous, login, csrf
            .addFilterBefore(tokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
            .authorizeHttpRequests(authorize -> authorize
                    .requestMatchers("/actuator/**").denyAll()
                    .anyRequest().permitAll());
    return httpSecurity.build();
}

where tokenAuthenticationFilter is a custom filter for JWT check, calls doFilter or throws 500.

At some point during the day I fiddled with the filter chain configuration, and managed to get a default 403 page for the actuator requests (as can be seeon above – they are all denied). Here is a screenshot of the page (from Postman) .

Now, for the life of me, I am just not able recreate that and get back that page. Now I get a default spring JSON response such as: {"status": 403, "endPoint": "/actuator"}

Every tutorial I read talks about redirecting to a Custom page, but that’s not what I want. I want the default one.

Thanks in advance, I hope I was clear enough in my question.