{"record":{"id":"02d962f05c561b84","repo":"spring-projects/spring-security","slug":"it-is-not-recommended-to-use-authorizerequests-or","errorCode":null,"errorMessage":"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests","messagePattern":"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration\\. Please only use authorizeHttpRequests","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurityFilterChainValidator.java","lineNumber":105,"sourceCode":"\t\t\t\tfilterChain = defaultChain;\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate void checkAuthorizationFilters(List<SecurityFilterChain> chains) {\n\t\tFilter authorizationFilter = null;\n\t\tFilter filterSecurityInterceptor = null;\n\t\tfor (SecurityFilterChain chain : chains) {\n\t\t\tfor (Filter filter : chain.getFilters()) {\n\t\t\t\tif (filter instanceof AuthorizationFilter) {\n\t\t\t\t\tauthorizationFilter = filter;\n\t\t\t\t}\n\t\t\t\tif (USING_ACCESS && AccessComponents.isFilterSecurityInterceptor(filter)) {\n\t\t\t\t\tfilterSecurityInterceptor = filter;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (authorizationFilter != null && filterSecurityInterceptor != null) {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t\t\"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests\");\n\t\t\t}\n\t\t\tif (filterSecurityInterceptor != null) {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t\t\"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration\");\n\t\t\t}\n\t\t\tauthorizationFilter = null;\n\t\t\tfilterSecurityInterceptor = null;\n\t\t}\n\t}\n\n\tprivate static final class AccessComponents {\n\n\t\tprivate static boolean isFilterSecurityInterceptor(Filter filter) {\n\t\t\treturn filter instanceof FilterSecurityInterceptor;\n\t\t}\n\n\t}","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurityFilterChainValidator.java#L87-L123","documentation":"WebSecurityFilterChainValidator.checkAuthorizationFilters() inspects each SecurityFilterChain for both AuthorizationFilter (the authorizeHttpRequests mechanism) and FilterSecurityInterceptor (the deprecated authorizeRequests mechanism). If both appear in the same chain, two authorization systems coexist with different semantics, and a warning is logged recommending authorizeHttpRequests only.","triggerScenarios":"A SecurityFilterChain containing both an AuthorizationFilter and a FilterSecurityInterceptor — e.g. an HttpSecurity config that configures both authorizeRequests() and authorizeHttpRequests(), or custom code that inserts a FilterSecurityInterceptor into a modern chain. validate() calls checkAuthorizationFilters at startup.","commonSituations":"Partially migrated configs where legacy authorizeRequests() rules were kept alongside new authorizeHttpRequests() rules; custom filters copied from old projects; XML http element coexisting with newer Java config adding AuthorizationFilter.","solutions":["Remove authorizeRequests()/FilterSecurityInterceptor and express all rules with authorizeHttpRequests().","If FilterSecurityInterceptor is still needed for method-security-like checks, remove the AuthorizationFilter from that chain so only one mechanism applies.","Audit all SecurityFilterChain beans (including custom ones) so each chain uses a single authorization model."],"exampleFix":"// before\nhttp.authorizeRequests(a -> a.antMatchers(\"/admin/**\").hasRole(\"ADMIN\"))\n    .authorizeHttpRequests(a -> a.anyRequest().authenticated());\n\n// after\nhttp.authorizeHttpRequests(a -> a.requestMatchers(\"/admin/**\").hasRole(\"ADMIN\").anyRequest().authenticated());","handlingStrategy":"validation","validationCode":"// Startup guard: only one authorization mechanism per chain\nboolean hasInterceptor = chain.getFilters().stream()\n    .anyMatch(f -> f instanceof FilterSecurityInterceptor);\nboolean hasAuthorizationFilter = chain.getFilters().stream()\n    .anyMatch(f -> f instanceof AuthorizationFilter);\nif (hasInterceptor && hasAuthorizationFilter) {\n    throw new IllegalStateException(\"Chain mixes FilterSecurityInterceptor and AuthorizationFilter\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only authorizeHttpRequests in all new and migrated configs.","During migration, move rules wholesale rather than incrementally mixing both APIs.","Inspect each SecurityFilterChain's filter list at startup in tests."],"tags":["spring-security","authorization","deprecation","filter-chain"],"backgroundTag":"deprecated-api-usage","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}