@Override
    public Response toResponse(UnauthorizedException exception) {

        if (LOG.isDebugEnabled()) {
            LOG.debug("unauthorized.", exception);
        }

        return Response.status(Status.FORBIDDEN).build();
    }
JAX-RS exception mapper used to map Shiro {@link UnauthorizedException} to HTTP status codes.
{@link UnauthorizedException} will be mapped to 403.

@since 1.4
support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/UnauthorizedExceptionExceptionMapper.java