{"record":{"id":"68193edd01ab3c75","repo":"spring-projects/spring-security","slug":"accountstatususerdetailschecker-disabled","errorCode":"AccountStatusUserDetailsChecker.disabled","errorMessage":"User is disabled","messagePattern":"User is disabled","errorType":"exception","errorClass":"DisabledException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/authentication/AccountStatusUserDetailsChecker.java","lineNumber":51,"sourceCode":" *\n * @author Luke Taylor\n */\npublic class AccountStatusUserDetailsChecker implements UserDetailsChecker, MessageSourceAware {\n\n\tprivate final Log logger = LogFactory.getLog(getClass());\n\n\tprotected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();\n\n\t@Override\n\tpublic void check(UserDetails user) {\n\t\tif (!user.isAccountNonLocked()) {\n\t\t\tthis.logger.debug(\"Failed to authenticate since user account is locked\");\n\t\t\tthrow new LockedException(\n\t\t\t\t\tthis.messages.getMessage(\"AccountStatusUserDetailsChecker.locked\", \"User account is locked\"));\n\t\t}\n\t\tif (!user.isEnabled()) {\n\t\t\tthis.logger.debug(\"Failed to authenticate since user account is disabled\");\n\t\t\tthrow new DisabledException(\n\t\t\t\t\tthis.messages.getMessage(\"AccountStatusUserDetailsChecker.disabled\", \"User is disabled\"));\n\t\t}\n\t\tif (!user.isAccountNonExpired()) {\n\t\t\tthis.logger.debug(\"Failed to authenticate since user account is expired\");\n\t\t\tthrow new AccountExpiredException(\n\t\t\t\t\tthis.messages.getMessage(\"AccountStatusUserDetailsChecker.expired\", \"User account has expired\"));\n\t\t}\n\t\tif (!user.isCredentialsNonExpired()) {\n\t\t\tthis.logger.debug(\"Failed to authenticate since user account credentials have expired\");\n\t\t\tthrow new CredentialsExpiredException(this.messages\n\t\t\t\t.getMessage(\"AccountStatusUserDetailsChecker.credentialsExpired\", \"User credentials have expired\"));\n\t\t}\n\t}\n\n\t/**\n\t * Sets the {@link MessageSource} used to resolve exception messages.\n\t * @since 5.2\n\t */","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/authentication/AccountStatusUserDetailsChecker.java#L33-L69","documentation":"AccountStatusUserDetailsChecker.check() validates a UserDetails after authentication. When UserDetails.isEnabled() returns false it throws DisabledException with message 'User is disabled'. This indicates the user account exists but is flagged as not enabled.","triggerScenarios":"DaoAuthenticationProvider (or any AuthenticationProvider using this checker) authenticates a user whose UserDetails.isEnabled() returns false.","commonSituations":"Newly registered users whose account requires email activation; admins disabling accounts; user records loaded from a DB column like enabled=0; custom UserDetailsService returning UserDetails with enabled hardcoded false.","solutions":["Enable the account: set the enabled flag to true in your user store or make isEnabled() return true in your UserDetails implementation","If activation is required, implement an activation flow that flips the enabled flag after verification","If the flag is loaded incorrectly, fix your UserDetailsService SQL/mapping so the enabled column is read properly","Catch DisabledException in an AuthenticationFailureHandler and show a 'contact administrator / activate account' message"],"exampleFix":"// before\n@Override\npublic boolean isEnabled() { return false; }\n// after\n@Override\npublic boolean isEnabled() { return this.enabled; } // persisted activation flag","handlingStrategy":"try-catch","validationCode":"UserDetails user = uds.loadUserByUsername(username);\nif (!user.isEnabled()) { throw new IllegalStateException(\"Account not activated: \" + username); }","typeGuard":"boolean isLoginAllowed(UserDetails u) { return u.isEnabled(); }","tryCatchPattern":"try { authMgr.authenticate(token); } catch (DisabledException e) { return ResponseEntity.status(403).body(\"Account is disabled. Please activate or contact support.\"); }","preventionTips":["Always persist and load an explicit enabled flag","Run the account-status checker in tests against representative users","Catch DisabledException separately from BadCredentialsException for clear UX"],"tags":["spring-security","authentication","account-disabled"],"backgroundTag":"authentication-required","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}