{"record":{"id":"394ef801d0f09036","repo":"spring-projects/spring-security","slug":"it-is-not-recommended-to-use-authorizerequests-or-394ef8","errorCode":null,"errorMessage":"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests","messagePattern":"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration\\. Please only use authorizeHttpRequests","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java","lineNumber":132,"sourceCode":"\t\t\t\tfilterChain = defaultChain;\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate void checkAuthorizationFilters(List<SecurityFilterChain> chains) {\n\t\tFilter authorizationFilter = null;\n\t\tFilter filterSecurityInterceptor = null;\n\t\tfor (SecurityFilterChain chain : chains) {\n\t\t\tfor (Filter filter : chain.getFilters()) {\n\t\t\t\tif (filter instanceof AuthorizationFilter) {\n\t\t\t\t\tauthorizationFilter = filter;\n\t\t\t\t}\n\t\t\t\tif (USING_ACCESS && AccessComponents.isFilterSecurityInterceptor(filter)) {\n\t\t\t\t\tfilterSecurityInterceptor = filter;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (authorizationFilter != null && filterSecurityInterceptor != null) {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t\t\"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests\");\n\t\t\t}\n\t\t\tif (filterSecurityInterceptor != null) {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t\t\"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration\");\n\t\t\t}\n\t\t\tauthorizationFilter = null;\n\t\t\tfilterSecurityInterceptor = null;\n\t\t}\n\t}\n\n\t@SuppressWarnings({ \"unchecked\" })\n\tprivate static <F extends Filter> F getFilter(Class<F> type, List<Filter> filters) {\n\t\tfor (Filter f : filters) {\n\t\t\tif (type.isAssignableFrom(f.getClass())) {\n\t\t\t\treturn (F) f;\n\t\t\t}\n\t\t}","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java#L114-L150","documentation":"DefaultFilterChainValidator (the validator used by the XML <http> / namespace configuration) checks each filter chain for a mix of AuthorizationFilter and FilterSecurityInterceptor. When both are found in one chain, it warns that running authorizeRequests (FilterSecurityInterceptor) alongside authorizeHttpRequests (AuthorizationFilter) is not recommended and that authorizeHttpRequests should be the only authorization mechanism.","triggerScenarios":"An XML/namespace-configured security setup (validated via DefaultFilterChainValidator.validate() -> checkAuthorizationFilters) whose chain contains both an AuthorizationFilter and a FilterSecurityInterceptor, e.g. <http> with legacy intercept-url plus manually added AuthorizationFilter.","commonSituations":"Hybrid XML + Java config migrations; adding authorizeHttpRequests-style filters to legacy <http> definitions; upgrading applications gradually while both authorization systems remain registered.","solutions":["Convert the legacy <intercept-url>/authorizeRequests rules to authorizeHttpRequests and remove FilterSecurityInterceptor from the chain.","If stuck on XML security, keep a single authorization mechanism per chain and migrate chain-by-chain.","Ensure no custom bean definitions inject a FilterSecurityInterceptor into chains that already use AuthorizationFilter."],"exampleFix":"// before\nhttp.authorizeRequests(a -> a.antMatchers(\"/api/**\").authenticated());\nhttp.addFilter(new AuthorizationFilter(manager));\n\n// after\nhttp.authorizeHttpRequests(a -> a.requestMatchers(\"/api/**\").authenticated());","handlingStrategy":"validation","validationCode":"// Namespace-config guard: ensure single authorization mechanism\nboolean mixed = filters.stream().anyMatch(f -> f instanceof FilterSecurityInterceptor)\n    && filters.stream().anyMatch(f -> f instanceof AuthorizationFilter);\nif (mixed) {\n    throw new IllegalStateException(\"XML http config mixes FilterSecurityInterceptor with AuthorizationFilter\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Migrate <http> intercept-url rules to authorizeHttpRequests before adding any new rules.","Avoid hand-adding AuthorizationFilter to XML-defined chains mid-migration.","Run DefaultFilterChainValidator output through CI log checks to catch mixed chains early."],"tags":["spring-security","authorization","deprecation","xml-config"],"backgroundTag":"deprecated-api-usage","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}