{"record":{"id":"8cdadc28eb301a93","repo":"spring-projects/spring-security","slug":"error-8cdadc","errorCode":null,"errorMessage":"\n\n********************************************************************\n**********        Security debugging is enabled.       *************\n**********    This may include sensitive information.  *************\n**********      Do not use in a production system!     *************\n********************************************************************\n\n","messagePattern":"\n\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*        Security debugging is enabled\\.       \\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*    This may include sensitive information\\.  \\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*      Do not use in a production system!     \\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java","lineNumber":360,"sourceCode":"\t\tif (this.httpFirewall != null) {\n\t\t\tfilterChainProxy.setFirewall(this.httpFirewall);\n\t\t}\n\t\tif (this.requestRejectedHandler != null) {\n\t\t\tfilterChainProxy.setRequestRejectedHandler(this.requestRejectedHandler);\n\t\t}\n\t\telse if (!this.observationRegistry.isNoop()) {\n\t\t\tCompositeRequestRejectedHandler requestRejectedHandler = new CompositeRequestRejectedHandler(\n\t\t\t\t\tnew ObservationMarkingRequestRejectedHandler(this.observationRegistry),\n\t\t\t\t\tnew HttpStatusRequestRejectedHandler());\n\t\t\tfilterChainProxy.setRequestRejectedHandler(requestRejectedHandler);\n\t\t}\n\t\tfilterChainProxy.setFilterChainValidator(new WebSecurityFilterChainValidator());\n\t\tfilterChainProxy.setFilterChainDecorator(getFilterChainDecorator());\n\t\tfilterChainProxy.afterPropertiesSet();\n\n\t\tFilter result = filterChainProxy;\n\t\tif (this.debugEnabled) {\n\t\t\tthis.logger.warn(\"\\n\\n\" + \"********************************************************************\\n\"\n\t\t\t\t\t+ \"**********        Security debugging is enabled.       *************\\n\"\n\t\t\t\t\t+ \"**********    This may include sensitive information.  *************\\n\"\n\t\t\t\t\t+ \"**********      Do not use in a production system!     *************\\n\"\n\t\t\t\t\t+ \"********************************************************************\\n\\n\");\n\t\t\tresult = new DebugFilter(filterChainProxy);\n\t\t}\n\n\t\tthis.postBuildAction.run();\n\t\treturn result;\n\t}\n\n\tprivate boolean addAuthorizationManager(SecurityFilterChain securityFilterChain,\n\t\t\tRequestMatcherDelegatingAuthorizationManager.Builder builder) {\n\t\tboolean mappings = false;\n\t\tfor (Filter filter : securityFilterChain.getFilters()) {\n\t\t\tif (USING_ACCESS) {\n\t\t\t\tmappings = AccessComponents.addAuthorizationManager(filter, this.servletContext, builder,\n\t\t\t\t\t\tsecurityFilterChain);","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java#L342-L378","documentation":"When debug support is on, WebSecurity.performBuild() wraps the FilterChainProxy in a DebugFilter and logs a prominent multi-line banner warning that security debugging is enabled and may expose sensitive information (request details, security context contents), so it must never run in production. The banner is the only signal; there is no failure.","triggerScenarios":"Calling @EnableWebSecurity(debug = true) or SecurityConfig with debug flag enabled, then booting the app — performBuild() detects this.debugEnabled and logs the banner before installing DebugFilter.","commonSituations":"Leaving debug=true enabled after local troubleshooting; copying a dev SecurityConfiguration class into production; enabling debug to diagnose filter-chain ordering issues and forgetting to disable it before deploy.","solutions":["Set @EnableWebSecurity(debug = false) (or remove the debug attribute, which defaults to false) in production profiles.","Externalize the debug flag so it is only true in local/dev profiles (e.g. via @Profile or a property).","Use FilterChainProxy logging or spring-security events instead of the debug filter when diagnosing production issues."],"exampleFix":"// before\n@EnableWebSecurity(debug = true)\npublic class SecurityConfig { }\n\n// after\n@EnableWebSecurity(debug = false)\npublic class SecurityConfig { }","handlingStrategy":"validation","validationCode":"// Fail startup in production if debug is enabled\nif (env.acceptsProfiles(Profiles.of(\"prod\")) && debugEnabled) {\n    throw new IllegalStateException(\"Spring Security debug must not be enabled in production\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hardcode debug = true; drive it from a dev-only profile or property.","Grep the codebase for @EnableWebSecurity(debug = true) in release pipelines.","Treat the banner warning in logs as a deploy blocker, not noise."],"tags":["spring-security","debug","security-risk","production"],"backgroundTag":"debug-enabled-in-production","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}