@Test
    public void testUserOnAccessDeniedWithResponseError() {
        // Tests when a user (known identity) is denied access and no unauthorizedUrl has been configured.
        // This should trigger an HTTP response error code.

        //log in the user using the account provided by the superclass for tests:
        runWithSubject(subject -> {
            subject.login(new UsernamePasswordToken("test", "test"));

            AuthorizationFilter filter = new AuthorizationFilter() {
                @Override
                protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
                    //for this test case
                    return false;
                }
            };

            HttpServletRequest request = mock(HttpServletRequest.class);
            HttpServletResponse response = mock(HttpServletResponse.class);

            // response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            filter.onAccessDenied(request, response);
            verify(response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
        });
    }
Test cases for the {@link AuthorizationFilter} class.
web/src/test/java/org/apache/shiro/web/filter/authz/AuthorizationFilterTest.java