{"record":{"id":"1a5f4b10000a3f46","repo":"spring-projects/spring-security","slug":"filtersecurityinterceptor-is-configured-to-reject","errorCode":null,"errorMessage":"FilterSecurityInterceptor is configured to reject public invocations. Your login page may not be accessible.","messagePattern":"FilterSecurityInterceptor is configured to reject public invocations\\. Your login page may not be accessible\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java","lineNumber":315,"sourceCode":"\t\tprivate static boolean isFilterSecurityInterceptor(Filter filter) {\n\t\t\treturn filter instanceof FilterSecurityInterceptor;\n\t\t}\n\n\t\tprivate static Class<FilterSecurityInterceptor> getFilterSecurityInterceptorClass() {\n\t\t\treturn FilterSecurityInterceptor.class;\n\t\t}\n\n\t\tprivate static Boolean checkLoginPageIsPublic(List<Filter> filters, HttpServletRequest loginRequest) {\n\t\t\tFilterSecurityInterceptor authorizationInterceptor = getFilter(FilterSecurityInterceptor.class, filters);\n\t\t\tif (authorizationInterceptor == null) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tFilterInvocationSecurityMetadataSource fids = authorizationInterceptor.getSecurityMetadataSource();\n\t\t\tCollection<ConfigAttribute> attributes = fids.getAttributes(loginRequest);\n\t\t\tif (attributes == null) {\n\t\t\t\tlogger.debug(\"No access attributes defined for login page URL\");\n\t\t\t\tif (authorizationInterceptor.isRejectPublicInvocations()) {\n\t\t\t\t\tlogger.warn(\"FilterSecurityInterceptor is configured to reject public invocations.\"\n\t\t\t\t\t\t\t+ \" Your login page may not be accessible.\");\n\t\t\t\t}\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\n\t\tprivate static Supplier<Boolean> getAnonymousCheck(List<Filter> filters, HttpServletRequest loginRequest,\n\t\t\t\tAnonymousAuthenticationToken token) {\n\t\t\tFilterSecurityInterceptor authorizationInterceptor = getFilter(FilterSecurityInterceptor.class, filters);\n\t\t\tif (authorizationInterceptor == null) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\treturn () -> {\n\t\t\t\tFilterInvocationSecurityMetadataSource source = authorizationInterceptor.getSecurityMetadataSource();\n\t\t\t\tCollection<ConfigAttribute> attributes = source.getAttributes(loginRequest);\n\t\t\t\ttry {\n\t\t\t\t\tauthorizationInterceptor.getAccessDecisionManager().decide(token, loginRequest, attributes);","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java#L297-L333","documentation":"During validation, DefaultFilterChainValidator checks whether the configured login page URL would be reachable. If FilterSecurityInterceptor has rejectPublicInvocations=true and no ConfigAttributes are defined for the login request, the login page would be denied, so this warning is logged to alert the developer that login may be inaccessible.","triggerScenarios":"checkLoginPageIsPublic finds no attributes for the login page URL in the FilterInvocationSecurityMetadataSource while the FilterSecurityInterceptor is configured to reject public (unsecured) invocations.","commonSituations":"Setting rejectPublicInvocations(true) on FilterSecurityInterceptor without explicitly defining access rules for the login/error pages; strict 'deny everything not explicitly permitted' configs.","solutions":["Add an explicit intercept rule permitting the login page (e.g. IS_AUTHENTICATED_ANONYMOUSLY/permitAll) for its URL","Set rejectPublicInvocations(false) on the FilterSecurityInterceptor","Migrate to authorizeHttpRequests with .requestMatchers(\"/login\").permitAll(), which avoids the interceptor entirely"],"exampleFix":"// before\ninterceptor.setRejectPublicInvocations(true); // login page has no attributes\n// after\nhttp.authorizeHttpRequests(auth -> auth\n  .requestMatchers(\"/login\").permitAll()\n  .anyRequest().authenticated());","handlingStrategy":"validation","validationCode":"// Verify public URLs are explicitly permitted before enabling rejectPublicInvocations\nboolean loginCovered = metadataSource.getAttributes(new FilterInvocation(\"/login\", \"GET\", null)) != null;\nif (rejectPublicInvocations && !loginCovered) { permitLoginUrl(); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always whitelist login, error, and static resource URLs before denying everything else","Test unauthenticated access to /login in integration tests","Avoid rejectPublicInvocations(true) unless the fail-closed behavior is a hard requirement"],"tags":["spring-security","login-page","access-control","configuration"],"backgroundTag":"conflicting-config-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}