我找到了一个解决方案，但不确定这是否是解决这个问题的“正确方法”。把它放在这里，以防有人发现它有用。
背景：spring security使用PersistentTokenBasedMemberMeservices类来处理基于持久令牌的验证。我创建了自己的自定义TokenBasedMemberMeservices类，将PersistentTokenBasedMemberMeservices中的所有代码复制到该类中。除了类名之外，代码完全相同。在ProcessAutologyCookie（..）方法中，我修改了抛出cookietheftexception的代码。相反，我抛出了rememberAuthenticationException。这解决了我的问题，不需要编写exceptionhandler。代码如下：

My SecurityConfig class:
    ..
    ..
    .and()
                .csrf().disable()
                .exceptionHandling().accessDeniedPage("/user/403/")
            .and()
                .rememberMe()
                .rememberMeParameter("remember-me")
                .rememberMeServices(tokenBasedRememberMeServices);
tokenBasedRememberMeServices is autowired to this class.

TokenBasedMemberMeservices（仅更改代码）：

@Service("tokenBasedRememberMeServices")
    public class TokenBasedRememberMeServices extends AbstractRememberMeServices {

    @Autowired(required = true)
        public TokenBasedRememberMeServices(@Value("${app.security.remember-me.key}") String key,
                @Qualifier("userInfoService") UserDetailsService userDetailsService,
                @Qualifier("rememberMePersistentTokenRepository") PersistentTokenRepository tokenRepository) {
            super(key, userDetailsService);
            random = new SecureRandom();
            this.tokenRepository = tokenRepository;
        }
    protected UserDetails processAutoLoginCookie(String[] cookieTokens, HttpServletRequest request, HttpServletResponse response) {
    ...
    ..
    // We have a match for this user/series combination
            if (!presentedToken.equals(token.getTokenValue())) {
                // Token doesn't match series value. Delete all logins for this user
                // and throw
                // an exception to warn them.
                tokenRepository.removeUserTokens(token.getUsername());
                String errorMessage = messages.getMessage("PersistentTokenBasedRememberMeServices.cookieStolen",
                        "Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.");
                log.warn("request token doesn't match with the one stored in database, {}", errorMessage);
                throw new RememberMeAuthenticationException(errorMessage);
            }
    ....
    ....
    }