code: protected function doFailureResponse(GetResponseEvent $event)
      {
          $headers = array();
          $content = 'Forbidden';
          if (in_array('application/json', $event->getRequest()->getAcceptableContentTypes())) {
              $headers['Content-Type'] = 'application/json';
              $content = json_encode(array('message' => $content));
          }
  
          $event->setResponse(new Response($content, 403, $headers));
      }
docs: Failure response
  
  Can be overridden if a different response is needed
  
  @param GetResponseEvent $event