{"record":{"id":"5a385894bd17dadc","repo":"spring-projects/spring-security","slug":"please-either-configure-an-authenticationconverter","errorCode":null,"errorMessage":"Please either configure an AuthenticationConverter or override attemptAuthentication when extending AbstractAuthenticationProcessingFilter","messagePattern":"Please either configure an AuthenticationConverter or override attemptAuthentication when extending AbstractAuthenticationProcessingFilter","errorType":"exception","errorClass":"AuthenticationCredentialsNotFoundException","httpStatus":null,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java","lineNumber":134,"sourceCode":" * implementations {@link #setSessionAuthenticationStrategy(SessionAuthenticationStrategy)\n * can be injected} to enable things like session-fixation attack prevention or to control\n * the number of simultaneous sessions a principal may have.\n *\n * @author Ben Alex\n * @author Luke Taylor\n */\npublic abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean\n\t\timplements ApplicationEventPublisherAware, MessageSourceAware {\n\n\tprivate SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder\n\t\t.getContextHolderStrategy();\n\n\tprotected @Nullable ApplicationEventPublisher eventPublisher;\n\n\tprotected AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new WebAuthenticationDetailsSource();\n\n\tprivate AuthenticationConverter authenticationConverter = (request) -> {\n\t\tthrow new AuthenticationCredentialsNotFoundException(\n\t\t\t\t\"Please either configure an AuthenticationConverter or override attemptAuthentication when extending AbstractAuthenticationProcessingFilter\");\n\t};\n\n\t@SuppressWarnings(\"NullAway.Init\")\n\tprivate AuthenticationManager authenticationManager;\n\n\tprotected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();\n\n\tprivate RememberMeServices rememberMeServices = new NullRememberMeServices();\n\n\tprivate RequestMatcher requiresAuthenticationRequestMatcher;\n\n\tprivate boolean continueChainBeforeSuccessfulAuthentication = false;\n\n\tprivate boolean continueChainWhenNoAuthenticationResult;\n\n\tprivate SessionAuthenticationStrategy sessionStrategy = new NullAuthenticatedSessionStrategy();\n","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java#L116-L152","documentation":"AbstractAuthenticationProcessingFilter by default installs a null-object AuthenticationConverter that always throws AuthenticationCredentialsNotFoundException, forcing subclasses to either set an AuthenticationConverter (used by the default attemptAuthentication) or override attemptAuthentication themselves. It is a configuration guard: the filter has no way to extract credentials from the request.","triggerScenarios":"Instantiating AbstractAuthenticationProcessingFilter (or a subclass that forgot setup, e.g. a plain new AbstractAuthenticationProcessingFilter(\"/login\") with no converter) and receiving a request; specifically UsernamePasswordAuthenticationFilter sets one, but custom subclasses frequently forget.","commonSituations":"Custom login filters subclassing AbstractAuthenticationProcessingFilter directly without calling setAuthenticationConverter or overriding attemptAuthentication; refactors to newer Spring Security (6.x) where the converter-based default was introduced; JSON login filters built atop the abstract class.","solutions":["Call setAuthenticationConverter(...) with your converter on the filter","Override attemptAuthentication(HttpServletRequest, HttpServletResponse) in your subclass to perform authentication manually","Prefer built-in filters (UsernamePasswordAuthenticationFilter, AuthenticationFilter) which already wire a converter"],"exampleFix":"// before\nMyAuthFilter f = new MyAuthFilter(\"/login\", authManager);\n// after\nMyAuthFilter f = new MyAuthFilter(\"/login\", authManager);\nf.setAuthenticationConverter(new MyJsonAuthenticationConverter());\n// or\n@Override\npublic Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) { ... }","handlingStrategy":"validation","validationCode":"AbstractAuthenticationProcessingFilter f = ...;\nif (f.getClass().getMethod(\"attemptAuthentication\")\n        .getDeclaringClass() == AbstractAuthenticationProcessingFilter.class\n    && getConverter(f) == null) {\n    throw new IllegalStateException(\"Filter needs an AuthenticationConverter\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    filter.doFilter(request, response, chain);\n} catch (AuthenticationCredentialsNotFoundException e) {\n    if (e.getMessage().contains(\"AuthenticationConverter\")) {\n        log.error(\"Filter misconfigured: set AuthenticationConverter or override attemptAuthentication\");\n    }\n    throw e;\n}","preventionTips":["Always call setAuthenticationConverter(...) in custom filter constructors","Or override attemptAuthentication in every subclass","Write a smoke test hitting the filter URL at startup"],"tags":["spring-security","authentication-filter","missing-configuration","custom-filter"],"backgroundTag":"missing-required-config","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}