{"record":{"id":"821d4a5306475f83","repo":"spring-projects/spring-security","slug":"security-interception-failed-due-to-s-secure-ob","errorCode":null,"errorMessage":"Security interception failed due to: %s; secure object: %s; configuration attributes: %s","messagePattern":"Security interception failed due to: (.+?); secure object: (.+?); configuration attributes: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"access/src/main/java/org/springframework/security/access/event/LoggerListener.java","lineNumber":58,"sourceCode":"\n\t@Override\n\tpublic void onApplicationEvent(AbstractAuthorizationEvent event) {\n\t\tif (event instanceof AuthenticationCredentialsNotFoundEvent) {\n\t\t\tonAuthenticationCredentialsNotFoundEvent((AuthenticationCredentialsNotFoundEvent) event);\n\t\t}\n\t\tif (event instanceof AuthorizationFailureEvent) {\n\t\t\tonAuthorizationFailureEvent((AuthorizationFailureEvent) event);\n\t\t}\n\t\tif (event instanceof AuthorizedEvent) {\n\t\t\tonAuthorizedEvent((AuthorizedEvent) event);\n\t\t}\n\t\tif (event instanceof PublicInvocationEvent) {\n\t\t\tonPublicInvocationEvent((PublicInvocationEvent) event);\n\t\t}\n\t}\n\n\tprivate void onAuthenticationCredentialsNotFoundEvent(AuthenticationCredentialsNotFoundEvent authEvent) {\n\t\tlogger.warn(LogMessage.format(\n\t\t\t\t\"Security interception failed due to: %s; secure object: %s; configuration attributes: %s\",\n\t\t\t\tauthEvent.getCredentialsNotFoundException(), authEvent.getSource(), authEvent.getConfigAttributes()));\n\t}\n\n\tprivate void onPublicInvocationEvent(PublicInvocationEvent event) {\n\t\tlogger.info(LogMessage.format(\"Security interception not required for public secure object: %s\",\n\t\t\t\tevent.getSource()));\n\t}\n\n\tprivate void onAuthorizedEvent(AuthorizedEvent authEvent) {\n\t\tlogger.info(LogMessage.format(\n\t\t\t\t\"Security authorized for authenticated principal: %s; secure object: %s; configuration attributes: %s\",\n\t\t\t\tauthEvent.getAuthentication(), authEvent.getSource(), authEvent.getConfigAttributes()));\n\t}\n\n\tprivate void onAuthorizationFailureEvent(AuthorizationFailureEvent authEvent) {\n\t\tlogger.warn(LogMessage.format(\n\t\t\t\t\"Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s\",","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/access/src/main/java/org/springframework/security/access/event/LoggerListener.java#L40-L76","documentation":"LoggerListener (an ApplicationListener) logs a WARN when it receives an AuthenticationCredentialsNotFoundEvent, meaning security interception was attempted on a secure object but no Authentication existed in the SecurityContextHolder at all (as opposed to a failed authentication). The message includes the exception, the secure object, and the required configuration attributes.","triggerScenarios":"An AuthorizationInterceptor/Aspect on a method or a security interceptor invoked with no SecurityContext authentication present, publishing AuthenticationCredentialsNotFoundEvent; enabling LoggerListener as a bean makes this event log at WARN.","commonSituations":"Calling a @PreAuthorize/@Secured-annotated method from a non-web or async context where the SecurityContext was not propagated; interceptor wired before any authentication filter ran; scheduled tasks lacking a runAs/system authentication.","solutions":["Ensure the SecurityContext is populated before the secured invocation (authentication filter, or explicitly set SecurityContextHolder).","For async/scheduled code, use DelegatingSecurityContextExecutor/Async or set a system authentication.","Remove or re-scope LoggerListener if the WARN noise is not wanted.","Verify method-security interception points are behind authentication machinery (e.g. correct proxy order)."],"exampleFix":"// before: async task loses security context\nexecutor.execute(() -> securedService.doWork());\n// after: propagate context\ndelegatingExecutor.execute(() -> securedService.doWork());\n// new DelegatingSecurityContextExecutor(delegate)","handlingStrategy":"try-catch","validationCode":"// ensure authentication exists before invoking secured methods\nif (SecurityContextHolder.getContext().getAuthentication() == null) {\n    throw new IllegalStateException(\"No authentication in context\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    securedService.doWork();\n} catch (AuthenticationCredentialsNotFoundException e) {\n    // set a system authentication or redirect user to login\n    SecurityContextHolder.getContext().setAuthentication(systemAuth);\n}","preventionTips":["Use DelegatingSecurityContext* wrappers for all async/scheduled work.","Call SecurityContextHolder.clearContext() carefully to avoid dropping context mid-flow.","Write tests that invoke secured beans with and without authentication.","Keep LoggerListener enabled in dev to catch missing-context bugs early."],"tags":["security","authorization","event-listener","logging"],"backgroundTag":"authentication-required","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}