@Test
    public void testUserOnAccessDeniedWithRedirect() {
        // Tests when a user (known identity) is denied access and an unauthorizedUrl *has* been configured.
        // This should trigger an HTTP redirect

        //log in the user using the account provided by the superclass for tests:
        runWithSubject(subject -> {
            subject.login(new UsernamePasswordToken("test", "test"));

            String unauthorizedUrl = "unauthorized.jsp";

            AuthorizationFilter filter = new AuthorizationFilter() {
                @Override
                protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
                    //for this test case
                    return false;
                }
            };
            filter.setUnauthorizedUrl(unauthorizedUrl);

            HttpServletRequest request = mock(HttpServletRequest.class);
            HttpServletResponse response = mock(HttpServletResponse.class);

            String encoded = "/" + unauthorizedUrl;
            when(response.encodeRedirectURL(unauthorizedUrl)).thenReturn(encoded);
            response.sendRedirect(encoded);

            filter.onAccessDenied(request, response);

            verify(response, atLeastOnce()).sendRedirect(encoded);
            verify(response).encodeRedirectURL(unauthorizedUrl);
        });
    }
Test cases for the {@link AuthorizationFilter} class.
web/src/test/java/org/apache/shiro/web/filter/authz/AuthorizationFilterTest.java