{"record":{"id":"34941255cfe36959","repo":"spring-projects/spring-security","slug":"usage-of-authorizerequests-and-filtersecurityinter-349412","errorCode":null,"errorMessage":"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration","messagePattern":"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated\\. Please use authorizeHttpRequests in the configuration","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java","lineNumber":136,"sourceCode":"\n\tprivate void checkAuthorizationFilters(List<SecurityFilterChain> chains) {\n\t\tFilter authorizationFilter = null;\n\t\tFilter filterSecurityInterceptor = null;\n\t\tfor (SecurityFilterChain chain : chains) {\n\t\t\tfor (Filter filter : chain.getFilters()) {\n\t\t\t\tif (filter instanceof AuthorizationFilter) {\n\t\t\t\t\tauthorizationFilter = filter;\n\t\t\t\t}\n\t\t\t\tif (USING_ACCESS && AccessComponents.isFilterSecurityInterceptor(filter)) {\n\t\t\t\t\tfilterSecurityInterceptor = filter;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (authorizationFilter != null && filterSecurityInterceptor != null) {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t\t\"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests\");\n\t\t\t}\n\t\t\tif (filterSecurityInterceptor != null) {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t\t\"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration\");\n\t\t\t}\n\t\t\tauthorizationFilter = null;\n\t\t\tfilterSecurityInterceptor = null;\n\t\t}\n\t}\n\n\t@SuppressWarnings({ \"unchecked\" })\n\tprivate static <F extends Filter> F getFilter(Class<F> type, List<Filter> filters) {\n\t\tfor (Filter f : filters) {\n\t\t\tif (type.isAssignableFrom(f.getClass())) {\n\t\t\t\treturn (F) f;\n\t\t\t}\n\t\t}\n\t\treturn null;\n\t}\n\n\t/**","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java#L118-L154","documentation":"DefaultFilterChainValidator detects that the XML HTTP security configuration uses the deprecated authorizeRequests()/intercept-url style backed by FilterSecurityInterceptor instead of the newer authorizeHttpRequests AuthorizationFilter. It logs a warning because FilterSecurityInterceptor is deprecated and will be removed; new code should migrate to the authorizeHttpRequests model.","triggerScenarios":"Parsing an XML <http> security configuration whose filter chain contains a FilterSecurityInterceptor (from <intercept-url>/authorizeRequests) without a matching AuthorizationFilter, during validation of the built FilterChainProxy.","commonSituations":"Legacy XML-based Spring Security configs upgraded to Spring Security 5.x/6.x; teams keeping intercept-url rules instead of porting to authorizeHttpRequests; partially migrated configs mixing old and new authorization styles.","solutions":["Migrate XML authorization rules to authorizeHttpRequests (Java DSL or XmlHttpRequestDsl) and remove <intercept-url>/FilterSecurityInterceptor","If staying on XML, move rules into an AuthorizationManager-backed configuration and ensure the chain uses AuthorizationFilter","If the warning must remain temporarily, verify both FilterSecurityInterceptor and AuthorizationFilter are not combined inconsistently and suppress noise until migration"],"exampleFix":"// before (XML style)\n<http>\n  <intercept-url pattern=\"/admin/**\" access=\"hasRole('ADMIN')\"/>\n</http>\n// after\nhttp\n  .authorizeHttpRequests(auth -> auth\n    .requestMatchers(\"/admin/**\").hasRole(\"ADMIN\")\n    .anyRequest().authenticated());","handlingStrategy":"validation","validationCode":"// At startup, scan FilterChainProxy filters\nboolean usesFsi = filterChainProxy.getFilters(\"/\").stream()\n    .anyMatch(f -> f instanceof FilterSecurityInterceptor);\nif (usesFsi) { planMigrationToAuthorizeHttpRequests(); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer the authorizeHttpRequests Java DSL for all new security configs","Audit XML <http> blocks for <intercept-url> usage during upgrades","Watch Spring Security deprecation warnings in CI logs"],"tags":["spring-security","deprecation","filter-chain","authorization"],"backgroundTag":"deprecated-api-usage","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}