spring security warning about the tag "access-denied-page" cvc-complex-type.3.2.2: Attribute 'access-denied-page' is not allowed to appear

Question

my ide is eclipse-luna . system is windows 7 Ultimate . i use spring security with copy *.jar to my project and "add to build path". please see the image about the warning

    <security:http auto-config="true" use-expressions="true" access-denied-page="/user/login/init">

    <security:intercept-url pattern="/manage/**" access="hasRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/user/index**" access="hasRole('ROLE_USER')" />

    <security:form-login login-page="/user/login/init"
        authentication-failure-url="/user/login/init"
        authentication-success-handler-ref="successHandler"
        authentication-failure-handler-ref="failureHandler"
        always-use-default-target='true' />

    <security:logout delete-cookies="JSESSIONID" invalidate-session="true" success-handler-ref="urlLogoutSuccessHandler" />

    <security:remember-me key="health" user-service-ref='userDetailsServiceImpl'/>
</security:http>

warning is “cvc-complex-type.3.2.2: Attribute 'access-denied-page' is not allowed to appear in element 'security:http'.”

last week is no warning about this ,i hava no change anything about *.jar or my project . but is warning now ?? i can't understand . it can work well about the warning . thank you for you help .

Answer 1

You may try to migrate from Spring Security 3.x to Spring Security 4.x.

The XML attribute http@access-denied-page was removed in favor of access-denied-handler@error-page. This means if you have something like this:

<http ... access-denied-page="/denied">
...
</http>

it needs to be replaced with:

<http ...>
    <access-denied-handler error-page="/denied"/>
</http>

More details click here, hope it works for you.

Answer 2

because i use spring security 3,bug access-denied-page is spring security 2 . so it will warn in my ide . we can use access-denied-handler replace access-denied-page

<security:access-denied-handler error-page="/user/login/init"/>