{"record":{"id":"0c6b1686c4f797f4","repo":"spring-projects/spring-security","slug":"you-are-asking-spring-security-to-ignore-s-this","errorCode":null,"errorMessage":"You are asking Spring Security to ignore %s. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.","messagePattern":"You are asking Spring Security to ignore (.+?)\\. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java","lineNumber":317,"sourceCode":"\t\tAssert.notNull(requestRejectedHandler, \"requestRejectedHandler cannot be null\");\n\t\tthis.requestRejectedHandler = requestRejectedHandler;\n\t\treturn this;\n\t}\n\n\t@Override\n\tprotected Filter performBuild() {\n\t\tAssert.state(!this.securityFilterChainBuilders.isEmpty(),\n\t\t\t\t() -> \"At least one SecurityBuilder<? extends SecurityFilterChain> needs to be specified. \"\n\t\t\t\t\t\t+ \"Typically this is done by exposing a SecurityFilterChain bean. \"\n\t\t\t\t\t\t+ \"More advanced users can invoke \" + WebSecurity.class.getSimpleName()\n\t\t\t\t\t\t+ \".addSecurityFilterChainBuilder directly\");\n\t\tint chainSize = this.ignoredRequests.size() + this.securityFilterChainBuilders.size();\n\t\tList<SecurityFilterChain> securityFilterChains = new ArrayList<>(chainSize);\n\t\tRequestMatcherDelegatingAuthorizationManager.Builder builder = RequestMatcherDelegatingAuthorizationManager\n\t\t\t.builder();\n\t\tboolean mappings = false;\n\t\tfor (RequestMatcher ignoredRequest : this.ignoredRequests) {\n\t\t\tWebSecurity.this.logger.warn(\"You are asking Spring Security to ignore \" + ignoredRequest\n\t\t\t\t\t+ \". This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.\");\n\t\t\tSecurityFilterChain securityFilterChain = new DefaultSecurityFilterChain(ignoredRequest);\n\t\t\tsecurityFilterChains.add(securityFilterChain);\n\t\t\tbuilder.add(ignoredRequest, SingleResultAuthorizationManager.permitAll());\n\t\t\tmappings = true;\n\t\t}\n\t\tfor (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : this.securityFilterChainBuilders) {\n\t\t\tSecurityFilterChain securityFilterChain = securityFilterChainBuilder.build();\n\t\t\tsecurityFilterChains.add(securityFilterChain);\n\t\t\tmappings = addAuthorizationManager(securityFilterChain, builder) || mappings;\n\t\t}\n\t\tif (this.privilegeEvaluator == null) {\n\t\t\tAuthorizationManager<HttpServletRequest> authorizationManager = mappings ? builder.build()\n\t\t\t\t\t: SingleResultAuthorizationManager.permitAll();\n\t\t\tAuthorizationManagerWebInvocationPrivilegeEvaluator privilegeEvaluator = new AuthorizationManagerWebInvocationPrivilegeEvaluator(\n\t\t\t\t\tauthorizationManager);\n\t\t\tprivilegeEvaluator.setServletContext(this.servletContext);\n\t\t\tif (this.privilegeEvaluatorRequestTransformer != null) {","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java#L299-L335","documentation":"WebSecurity.performBuild() builds one-pass SecurityFilterChains for each request matcher registered via WebSecurity.ignoring(). Because ignored requests bypass the entire filter chain (no security at all), Spring Security logs this warning pointing developers to authorizeHttpRequests with permitAll, which keeps the security filters (headers, CSRF, context, etc.) running while still permitting access.","triggerScenarios":"Configuring WebSecurity with ignoring() matchers, e.g. @Override public void configure(WebSecurity web) { web.ignoring().antMatchers(\"/css/**\"); }, or web.ignoring().requestMatchers(...). Every ignoring() entry produces one warning at startup.","commonSituations":"Excluding static resources from security for performance; copying legacy web.ignoring() config forward from Spring Security 3/4; trying to fix 401s on health endpoints by ignoring them entirely.","solutions":["Replace web.ignoring() matchers with http.authorizeHttpRequests(a -> a.requestMatchers(\"/css/**\").permitAll()) so filters still run.","If the ignore is intentional for a truly non-HTTP-security path (e.g. performance-critical static serving handled by the container), keep it but document it and accept the warning.","Restrict ignoring() to as narrow a path set as possible and never for authenticated resources."],"exampleFix":"// before\n@Override\npublic void configure(WebSecurity web) {\n    web.ignoring().requestMatchers(\"/css/**\", \"/js/**\");\n}\n\n// after\n@Override\nprotected void configure(HttpSecurity http) throws Exception {\n    http.authorizeHttpRequests(a -> a.requestMatchers(\"/css/**\", \"/js/**\").permitAll().anyRequest().authenticated());\n}","handlingStrategy":"validation","validationCode":"// CI check: fail build if ignoring() appears in WebSecurityConfigurer\nif (sourceCode.contains(\"web.ignoring()\")) {\n    throw new IllegalStateException(\"Use permitAll via authorizeHttpRequests instead of web.ignoring()\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default to permitAll in HttpSecurity rather than WebSecurity.ignoring().","Reserve ignoring() for static resources served without any security filter needs, and document each case.","Review security config in code review whenever ignoring() is added."],"tags":["spring-security","authorization","filter-chain","best-practice"],"backgroundTag":"deprecated-api-usage","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}