I have the following web security config class:

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
public class WebSecurityConfig {
  @Bean
  public SecurityFilterChain webSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(authorize ->
                                   authorize
                                       .requestMatchers("/actuator/health").permitAll()
                                       .anyRequest().authenticated()
        )
        .oauth2Login(withDefaults())
        .exceptionHandling(ex -> ex.accessDeniedPage("access-denied.html"));
    return http.build();
  }
}

And a controller like:

@PreAuthorize("hasAuthority('approle_developer')")
  @GetMapping("/bar")
  public String foobar(@RequestParam long param) {
    return "foo";
  }

If i now try to access that page with the wrong authority spring throws as expected the AccessDeniedException but it redirects to /error instead of my expectation to access-denied.html. So it seems to invoke springs BasicErrorController but as far as i understand it should be overwritten by my config. Or does the config only work if the oauth process throws a 403 and not if my PreAuthorize Annotation creates this exception? Am i missing something?