{"record":{"id":"31457a8e19669223","repo":"spring-projects/spring-security","slug":"invalid-configuration-that-explicitly-sets-require","errorCode":null,"errorMessage":"Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy to {} but implicitly requires it due to the following properties being set: {}","messagePattern":"Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy to (.+?) but implicitly requires it due to the following properties being set: (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java","lineNumber":426,"sourceCode":"\t\t}\n\t\tif (!this.enableSessionUrlRewriting) {\n\t\t\thttp.addFilter(new DisableEncodeUrlFilter());\n\t\t}\n\t\tif (this.sessionPolicy == SessionCreationPolicy.ALWAYS) {\n\t\t\thttp.addFilter(new ForceEagerSessionCreationFilter());\n\t\t}\n\t}\n\n\tprivate boolean shouldRequireExplicitAuthenticationStrategy() {\n\t\tboolean defaultRequireExplicitAuthenticationStrategy = this.propertiesThatRequireImplicitAuthentication\n\t\t\t.isEmpty();\n\t\tif (this.requireExplicitAuthenticationStrategy == null) {\n\t\t\t// explicit is not set, use default\n\t\t\treturn defaultRequireExplicitAuthenticationStrategy;\n\t\t}\n\t\tif (this.requireExplicitAuthenticationStrategy && !defaultRequireExplicitAuthenticationStrategy) {\n\t\t\t// explicit disabled and implicit requires it\n\t\t\tthrow new IllegalStateException(\n\t\t\t\t\t\"Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy to \"\n\t\t\t\t\t\t\t+ this.requireExplicitAuthenticationStrategy\n\t\t\t\t\t\t\t+ \" but implicitly requires it due to the following properties being set: \"\n\t\t\t\t\t\t\t+ this.propertiesThatRequireImplicitAuthentication);\n\t\t}\n\t\treturn this.requireExplicitAuthenticationStrategy;\n\t}\n\n\tprivate SessionManagementFilter createSessionManagementFilter(H http) {\n\t\tif (shouldRequireExplicitAuthenticationStrategy()) {\n\t\t\treturn null;\n\t\t}\n\t\tSecurityContextRepository securityContextRepository = this.sessionManagementSecurityContextRepository;\n\t\tSessionManagementFilter sessionManagementFilter = new SessionManagementFilter(securityContextRepository,\n\t\t\t\tgetSessionAuthenticationStrategy(http));\n\t\tif (this.sessionAuthenticationErrorUrl != null) {\n\t\t\tsessionManagementFilter.setAuthenticationFailureHandler(\n\t\t\t\t\tnew SimpleUrlAuthenticationFailureHandler(this.sessionAuthenticationErrorUrl));","sourceCodeStart":408,"sourceCodeEnd":444,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java#L408-L444","documentation":"SessionManagementConfigurer checks whether explicit requireExplicitAuthenticationStrategy(true) conflicts with implicit requirements. If properties such as session fixation protection, session concurrency, or session-authentication settings implicitly require an explicit authentication strategy (default would be true), but the developer explicitly set requireExplicitAuthenticationStrategy(false), shouldRequireExplicitAuthenticationStrategy() throws IllegalStateException listing the offending properties.","triggerScenarios":"Calling sessionManagement(s -> s.requireExplicitAuthenticationStrategy(false)) while other settings on the same configurer (tracked in propertiesThatRequireImplicitAuthentication, e.g. sessionAuthenticationErrorUrl, maximumSessions, sessionAuthenticationStrategy customizations) implicitly require it true.","commonSituations":"Disabling explicit-strategy requirement to silence warnings while keeping concurrency-control or session-fixation settings active; merging configurations where one part sets the flag false and another enables session management features.","solutions":["Remove requireExplicitAuthenticationStrategy(false) so the implicit requirement (true) applies","Remove the session-management features that require implicit explicit-authentication strategy (e.g. maximumSessions, sessionAuthenticationErrorUrl, session-fixation customization) if the flag false is truly desired","Read the exception message — it lists exactly which properties caused the conflict — and reconcile those with the flag"],"exampleFix":"// before\nhttp.sessionManagement(s -> s.requireExplicitAuthenticationStrategy(false).maximumSessions(1));\n// after\nhttp.sessionManagement(s -> s.maximumSessions(1)); // drop the explicit false\n// or drop maximumSessions if explicit false is required","handlingStrategy":"validation","validationCode":"// before setting the flag\nboolean implicitRequired = usesMaximumSessions || hasSessionAuthenticationErrorUrl\n        || usesSessionFixationProtection || hasCustomSessionAuthenticationStrategy;\nif (implicitRequired && explicitFalseSet) {\n    throw new IllegalStateException(\"requireExplicitAuthenticationStrategy(false) conflicts with session-management settings that require it\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    http.sessionManagement(s -> s.maximumSessions(1));\n} catch (IllegalStateException e) {\n    if (e.getMessage().startsWith(\"Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy\")) {\n        // reconcile: drop the explicit false or the conflicting properties named in the message\n    }\n}","preventionTips":["Never set requireExplicitAuthenticationStrategy(false) while using maximumSessions/session-fixation/sessionAuthentication features","The exception message lists the conflicting properties — read it before changing config","Keep session-management settings in one place so implicit requirements are visible"],"tags":["spring-security","session-management","configuration","illegal-state"],"backgroundTag":"conflicting-config-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}