{"record":{"id":"1ecce736014888ad","repo":"spring-projects/spring-security","slug":"no-pre-authenticated-credentials-found-in-request","errorCode":null,"errorMessage":"No pre-authenticated credentials found in request.","messagePattern":"No pre-authenticated credentials found in request\\.","errorType":"exception","errorClass":"BadCredentialsException","httpStatus":null,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedAuthenticationProvider.java","lineNumber":102,"sourceCode":"\t * be ignored to allow other providers to authenticate it.\n\t */\n\t@Override\n\tpublic @Nullable Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tif (!supports(authentication.getClass())) {\n\t\t\treturn null;\n\t\t}\n\t\tlogger.debug(LogMessage.format(\"PreAuthenticated authentication request: %s\", authentication));\n\t\tif (authentication.getPrincipal() == null) {\n\t\t\tlogger.debug(\"No pre-authenticated principal found in request.\");\n\t\t\tif (this.throwExceptionWhenTokenRejected) {\n\t\t\t\tthrow new BadCredentialsException(\"No pre-authenticated principal found in request.\");\n\t\t\t}\n\t\t\treturn null;\n\t\t}\n\t\tif (authentication.getCredentials() == null) {\n\t\t\tlogger.debug(\"No pre-authenticated credentials found in request.\");\n\t\t\tif (this.throwExceptionWhenTokenRejected) {\n\t\t\t\tthrow new BadCredentialsException(\"No pre-authenticated credentials found in request.\");\n\t\t\t}\n\t\t\treturn null;\n\t\t}\n\t\tUserDetails userDetails = this.preAuthenticatedUserDetailsService\n\t\t\t.loadUserDetails((PreAuthenticatedAuthenticationToken) authentication);\n\t\tthis.userDetailsChecker.check(userDetails);\n\t\tCollection<GrantedAuthority> authorities = new LinkedHashSet<>(userDetails.getAuthorities());\n\t\tauthorities.addAll(this.grantedAuthoritySupplier.get());\n\t\tPreAuthenticatedAuthenticationToken result = new PreAuthenticatedAuthenticationToken(userDetails,\n\t\t\t\tauthentication.getCredentials(), authorities);\n\t\tresult.setDetails(authentication.getDetails());\n\t\treturn result;\n\t}\n\n\t/**\n\t * Indicate that this provider only supports PreAuthenticatedAuthenticationToken\n\t * (sub)classes.\n\t */","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedAuthenticationProvider.java#L84-L120","documentation":"PreAuthenticatedAuthenticationProvider.authenticate() rejects any PreAuthenticatedAuthenticationToken whose credentials are null. Pre-auth tokens carry the pre-authenticated 'credential' evidence (e.g. a certificate or the raw header); without it the provider treats the token as invalid and throws BadCredentialsException if throwExceptionWhenTokenRejected is true, otherwise returns null so another provider can be tried.","triggerScenarios":"Calling authenticate() with a PreAuthenticatedAuthenticationToken built as new PreAuthenticatedAuthenticationToken(principal, null), or an upstream filter that populated the principal but left credentials empty, while throwExceptionWhenTokenRejected=true.","commonSituations":"Custom AbstractPreAuthenticatedProcessingFilter subclass that returns the SSO user but null for getPreAuthenticatedCredentials; client-cert (X.509) setups where the certificate was not presented by the client; test code constructing tokens with only a principal.","solutions":["Make your pre-auth filter's getPreAuthenticatedCredentials() return non-null (commonly the request header value or the HttpServletRequest itself).","Set throwExceptionWhenTokenRejected=false to skip this provider rather than throw when credentials are missing.","If using X.509/client-cert auth, verify the client actually sends the certificate and TLS client-auth is configured on the connector.","In tests, build the token with both arguments: new PreAuthenticatedAuthenticationToken(\"user\", \"creds\")."],"exampleFix":"// before\n@Override\nprotected Object getPreAuthenticatedCredentials(HttpServletRequest request) {\n    return null; // triggers BadCredentialsException\n}\n// after\n@Override\nprotected Object getPreAuthenticatedCredentials(HttpServletRequest request) {\n    return request.getHeader(\"X-PreAuth-Token\");\n}","handlingStrategy":"validation","validationCode":"if (token.getCredentials() == null) {\n    throw new IllegalStateException(\"Pre-auth token has no credentials; fix getPreAuthenticatedCredentials()\");\n}\nprovider.authenticate(token);","typeGuard":"boolean hasCredentials = (auth != null && auth.getCredentials() != null);","tryCatchPattern":null,"preventionTips":["Implement getPreAuthenticatedCredentials() in every custom pre-auth filter (returning the header or request is conventional)","For client-cert auth, confirm TLS client-auth is enabled on the connector","Test the full filter chain, not just the provider, in integration tests"],"tags":["spring-security","preauth","bad-credentials","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}