Authorization - Permissions for public and secure portions of site

Rohit,

If user do not have access to page then they get 403 status code. But since for CQ no access = pages does not exist, thats why you are seeing 404 page. You can always extend your 404 under /apps/sling/servlet/errorhandler/default.jsp and 404.jsp to show correct behavior. You can also manage your custom redirect or pop up here.

Sample code snippet for default.jsp 

int statusCode = (scObject != null) ? scObject.intValue() : HttpServletResponse.SC_INTERNAL_SERVER_ERROR;

    if(statusCode==404){

        boolean pageExist = true;

        ResourceResolverFactory rrfac = sling.getService(ResourceResolverFactory.class);

        Map<String,Object> authInfo = new HashMap<String,Object>();

        //Change this code in future to use read only user

        authInfo.put(ResourceResolverFactory.USER_IMPERSONATION,"SOME USER WITH READ ACCESS");

        ResourceResolver rr=null;

        try{

            rr = rrfac.getAdministrativeResourceResolver(authInfo);

            //You want to ideally check for .html resources. All other resources should be egnored

            pageExist = (!slingRequest.getRequestURI().endsWith(".json") && !slingRequest.getRequestURI().endsWith(".xml") && !(rr.resolve(slingRequest,slingRequest.getRequestURI()) instanceof NonExistingResource)); 

        }catch(Exception e){

            pageExist=false;

        }finally{

            if(rr!=null){

                rr.close();

            }

        }

        // Handle 403

        if(pageExist && statusCode==404){

            Externalizer externalizer = sling.getService(Externalizer.class);

            if ( url.contains("/SOMELINK/") ){

                pageURL = YOUR CUSTOM 403 PAGE;

             }else{

                 pageURL = SOME OTHER CUSTOM 403;

             }

            statusCode = 403;

        }

Yogesh