How do I return a 403 Forbidden in Spring MVC?

You can also just throw

org.springframework.security.access.AccessDeniedException("403 returned");

This returns a 403 in the response header.