{"record":{"id":"320e956bf1a8ab73","repo":"spring-projects/spring-security","slug":"could-not-validate-configuration-attributes-as-the","errorCode":null,"errorMessage":"Could not validate configuration attributes as the SecurityMetadataSource did not return any attributes from getAllConfigAttributes()","messagePattern":"Could not validate configuration attributes as the SecurityMetadataSource did not return any attributes from getAllConfigAttributes\\(\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"access/src/main/java/org/springframework/security/access/intercept/AbstractSecurityInterceptor.java","lineNumber":170,"sourceCode":"\t\tAssert.notNull(this.messages, \"A message source must be set\");\n\t\tAssert.notNull(this.authenticationManager, \"An AuthenticationManager is required\");\n\t\tAssert.notNull(this.accessDecisionManager, \"An AccessDecisionManager is required\");\n\t\tAssert.notNull(this.runAsManager, \"A RunAsManager is required\");\n\t\tAssert.notNull(this.obtainSecurityMetadataSource(), \"An SecurityMetadataSource is required\");\n\t\tAssert.isTrue(this.obtainSecurityMetadataSource().supports(getSecureObjectClass()),\n\t\t\t\t() -> \"SecurityMetadataSource does not support secure object class: \" + getSecureObjectClass());\n\t\tAssert.isTrue(this.runAsManager.supports(getSecureObjectClass()),\n\t\t\t\t() -> \"RunAsManager does not support secure object class: \" + getSecureObjectClass());\n\t\tAssert.isTrue(this.accessDecisionManager.supports(getSecureObjectClass()),\n\t\t\t\t() -> \"AccessDecisionManager does not support secure object class: \" + getSecureObjectClass());\n\t\tif (this.afterInvocationManager != null) {\n\t\t\tAssert.isTrue(this.afterInvocationManager.supports(getSecureObjectClass()),\n\t\t\t\t\t() -> \"AfterInvocationManager does not support secure object class: \" + getSecureObjectClass());\n\t\t}\n\t\tif (this.validateConfigAttributes) {\n\t\t\tCollection<ConfigAttribute> attributeDefs = this.obtainSecurityMetadataSource().getAllConfigAttributes();\n\t\t\tif (attributeDefs == null) {\n\t\t\t\tthis.logger.warn(\"Could not validate configuration attributes as the \"\n\t\t\t\t\t\t+ \"SecurityMetadataSource did not return any attributes from getAllConfigAttributes()\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tvalidateAttributeDefs(attributeDefs);\n\t\t}\n\t}\n\n\tprivate void validateAttributeDefs(Collection<ConfigAttribute> attributeDefs) {\n\t\tSet<ConfigAttribute> unsupportedAttrs = new HashSet<>();\n\t\tfor (ConfigAttribute attr : attributeDefs) {\n\t\t\tif (!this.runAsManager.supports(attr) && !this.accessDecisionManager.supports(attr)\n\t\t\t\t\t&& ((this.afterInvocationManager == null) || !this.afterInvocationManager.supports(attr))) {\n\t\t\t\tunsupportedAttrs.add(attr);\n\t\t\t}\n\t\t}\n\t\tif (unsupportedAttrs.size() != 0) {\n\t\t\tthis.logger\n\t\t\t\t.trace(\"Did not validate configuration attributes since validateConfigurationAttributes is false\");","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/access/src/main/java/org/springframework/security/access/intercept/AbstractSecurityInterceptor.java#L152-L188","documentation":"AbstractSecurityInterceptor.afterPropertiesSet validates that all ConfigAttributes returned by the SecurityMetadataSource are understood by the AccessDecisionManager/AuthorizationManager and AfterInvocationManager. If obtainSecurityMetadataSource().getAllConfigAttributes() returns null, attribute validation cannot run and a WARN is logged instead, so misconfigured attributes would go undetected. It is a warning about skipped validation, not a hard failure.","triggerScenarios":"Calling afterPropertiesSet (bean initialization of any security interceptor, e.g. FilterSecurityInterceptor/MethodSecurityInterceptor) with validateConfigAttributes=true and a SecurityMetadataSource whose getAllConfigAttributes() returns null.","commonSituations":"Custom SecurityMetadataSource implementations that do not (or cannot) enumerate attributes at startup; dynamic/attribute-at-lookup-time sources returning null; wiring interceptors manually rather than via the namespace/DSL which sets a validating source.","solutions":["Implement getAllConfigAttributes() in the custom SecurityMetadataSource to return the full set of attributes (return an empty collection rather than null if enumeration is intentionally skipped).","Return Collections.emptyList() when there are no enumerable attributes, so validation proceeds harmlessly.","Alternatively set validateConfigAttributes=false on the interceptor if validation is not applicable.","If attributes come from a static source, switch to the framework-provided implementations that support enumeration."],"exampleFix":"// before\n@Override\npublic Collection<ConfigAttribute> getAllConfigAttributes() {\n    return null; // triggers warning, validation skipped\n}\n// after\n@Override\npublic Collection<ConfigAttribute> getAllConfigAttributes() {\n    return Collections.emptyList();\n}","handlingStrategy":"validation","validationCode":"// check the metadata source enumerates attributes at startup\nCollection<ConfigAttribute> attrs =\n    securityMetadataSource.getAllConfigAttributes();\nif (attrs == null) {\n    throw new IllegalStateException(\n        \"getAllConfigAttributes() must not return null\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Return an empty collection, never null, from custom SecurityMetadataSource.getAllConfigAttributes().","Keep validateConfigAttributes=true so misconfigured attributes fail early.","Cover custom metadata sources with unit tests for getAllConfigAttributes().","Check startup logs for the 'Could not validate configuration attributes' warning in CI."],"tags":["security","interceptor","config-attributes","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}