{"record":{"id":"398f1bddaf4a0936","repo":"spring-projects/spring-security","slug":"usage-of-authorizerequests-and-filtersecurityinter","errorCode":null,"errorMessage":"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration","messagePattern":"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated\\. Please use authorizeHttpRequests in the configuration","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurityFilterChainValidator.java","lineNumber":109,"sourceCode":"\n\tprivate void checkAuthorizationFilters(List<SecurityFilterChain> chains) {\n\t\tFilter authorizationFilter = null;\n\t\tFilter filterSecurityInterceptor = null;\n\t\tfor (SecurityFilterChain chain : chains) {\n\t\t\tfor (Filter filter : chain.getFilters()) {\n\t\t\t\tif (filter instanceof AuthorizationFilter) {\n\t\t\t\t\tauthorizationFilter = filter;\n\t\t\t\t}\n\t\t\t\tif (USING_ACCESS && AccessComponents.isFilterSecurityInterceptor(filter)) {\n\t\t\t\t\tfilterSecurityInterceptor = filter;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (authorizationFilter != null && filterSecurityInterceptor != null) {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t\t\"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests\");\n\t\t\t}\n\t\t\tif (filterSecurityInterceptor != null) {\n\t\t\t\tthis.logger.warn(\n\t\t\t\t\t\t\"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration\");\n\t\t\t}\n\t\t\tauthorizationFilter = null;\n\t\t\tfilterSecurityInterceptor = null;\n\t\t}\n\t}\n\n\tprivate static final class AccessComponents {\n\n\t\tprivate static boolean isFilterSecurityInterceptor(Filter filter) {\n\t\t\treturn filter instanceof FilterSecurityInterceptor;\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":91,"sourceCodeEnd":126,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurityFilterChainValidator.java#L91-L126","documentation":"During startup validation, WebSecurityFilterChainValidator.checkAuthorizationFilters() logs this warning whenever a SecurityFilterChain still contains a FilterSecurityInterceptor, i.e. the configuration uses the deprecated authorizeRequests()/interceptor model. Unlike error 696, this fires for FilterSecurityInterceptor even without an AuthorizationFilter in the same chain, and states that the mechanism is deprecated.","triggerScenarios":"Any validated SecurityFilterChain where AccessComponents.isFilterSecurityInterceptor(filter) matches a filter — produced by http.authorizeRequests(...) or explicitly added FilterSecurityInterceptor beans — when WebSecurityFilterChainValidator.validate() runs at startup.","commonSituations":"Upgrading Spring Security 5.x to 6.x while keeping authorizeRequests configs; legacy XML <http> security; third-party integrations that still register FilterSecurityInterceptor.","solutions":["Migrate to http.authorizeHttpRequests(...) and delete the authorizeRequests() configuration.","Replace explicit FilterSecurityInterceptor beans with AuthorizationFilter and an AuthorizationManager.","If migration must wait, isolate the legacy chain and plan removal, since FilterSecurityInterceptor is slated for deletion."],"exampleFix":"// before\nhttp.authorizeRequests(a -> a.antMatchers(\"/public/**\").permitAll().anyRequest().authenticated());\n\n// after\nhttp.authorizeHttpRequests(a -> a.requestMatchers(\"/public/**\").permitAll().anyRequest().authenticated());","handlingStrategy":"validation","validationCode":"boolean legacy = chain.getFilters().stream()\n    .anyMatch(f -> f instanceof FilterSecurityInterceptor);\nif (legacy) {\n    throw new IllegalStateException(\"FilterSecurityInterceptor is deprecated; migrate to authorizeHttpRequests\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Plan the authorizeRequests -> authorizeHttpRequests migration before upgrading to Spring Security 6.","Replace custom FilterSecurityInterceptor beans with AuthorizationFilter + AuthorizationManager.","Monitor startup logs for deprecation warnings in CI so regressions are caught."],"tags":["spring-security","authorization","deprecation","migration"],"backgroundTag":"deprecated-api-usage","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}