{"record":{"id":"8cfdd7d36e84ea61","repo":"spring-projects/spring-security","slug":"security-authorization-failed-due-to-s-authenti","errorCode":null,"errorMessage":"Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s","messagePattern":"Security authorization failed due to: (.+?); authenticated principal: (.+?); secure object: (.+?); configuration attributes: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"access/src/main/java/org/springframework/security/access/event/LoggerListener.java","lineNumber":75,"sourceCode":"\tprivate void onAuthenticationCredentialsNotFoundEvent(AuthenticationCredentialsNotFoundEvent authEvent) {\n\t\tlogger.warn(LogMessage.format(\n\t\t\t\t\"Security interception failed due to: %s; secure object: %s; configuration attributes: %s\",\n\t\t\t\tauthEvent.getCredentialsNotFoundException(), authEvent.getSource(), authEvent.getConfigAttributes()));\n\t}\n\n\tprivate void onPublicInvocationEvent(PublicInvocationEvent event) {\n\t\tlogger.info(LogMessage.format(\"Security interception not required for public secure object: %s\",\n\t\t\t\tevent.getSource()));\n\t}\n\n\tprivate void onAuthorizedEvent(AuthorizedEvent authEvent) {\n\t\tlogger.info(LogMessage.format(\n\t\t\t\t\"Security authorized for authenticated principal: %s; secure object: %s; configuration attributes: %s\",\n\t\t\t\tauthEvent.getAuthentication(), authEvent.getSource(), authEvent.getConfigAttributes()));\n\t}\n\n\tprivate void onAuthorizationFailureEvent(AuthorizationFailureEvent authEvent) {\n\t\tlogger.warn(LogMessage.format(\n\t\t\t\t\"Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s\",\n\t\t\t\tauthEvent.getAccessDeniedException(), authEvent.getAuthentication(), authEvent.getSource(),\n\t\t\t\tauthEvent.getConfigAttributes()));\n\t}\n\n}\n","sourceCodeStart":57,"sourceCodeEnd":82,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/access/src/main/java/org/springframework/security/access/event/LoggerListener.java#L57-L82","documentation":"LoggerListener logs a WARN when it receives an AuthorizationFailureEvent, meaning an authenticated principal attempted to access a secure object and the access decision was denied (AccessDeniedException). The message carries the denial exception, the authenticated principal, the secure object, and the required configuration attributes.","triggerScenarios":"Any denied access decision publishing AuthorizationFailureEvent: an authenticated user lacking required roles/authorities on a URL (authorizeHttpRequests) or method (@PreAuthorize/@PostAuthorize), with LoggerListener registered to log it.","commonSituations":"Users without the expected role hitting admin endpoints; method-security SpEL referencing wrong role names (missing ROLE_ prefix); CSRF-denied POSTs surfacing as authorization failures; authority mapping errors in UserDetailsService/JWT converters.","solutions":["Inspect the logged principal's authorities and the required config attributes; grant the missing authority or relax the rule.","Check role naming: hasRole('ADMIN') requires authority ROLE_ADMIN; use hasAuthority for exact matching.","Verify the JWT/converter maps the expected claims into GrantedAuthorities.","If denials are expected (attack traffic), keep as WARN or scope LoggerListener to specific packages."],"exampleFix":"// before: rule demands role user lacks\nhttp.authorizeHttpRequests(a -> a.requestMatchers(\"/admin/**\").hasRole(\"ADMIN\"));\n// after: map authority correctly or permit the intended role\nhttp.authorizeHttpRequests(a -> a.requestMatchers(\"/admin/**\")\n        .hasAuthority(\"ROLE_ADMIN\"));","handlingStrategy":"validation","validationCode":"// verify the principal's authorities include the required attribute\nCollection<? extends GrantedAuthority> auths =\n    SecurityContextHolder.getContext().getAuthentication().getAuthorities();\nboolean ok = auths.stream().anyMatch(a -> a.getAuthority().equals(\"ROLE_ADMIN\"));\nif (!ok) throw new AccessDeniedException(\"Missing ROLE_ADMIN\");","typeGuard":null,"tryCatchPattern":"try {\n    chain.doFilter(req, res);\n} catch (AccessDeniedException e) {\n    // authenticated but insufficient rights: forward to /403, not login\n    request.getRequestDispatcher(\"/403\").forward(req, res);\n}","preventionTips":["Standardize role naming (ROLE_ prefix) across config and token mappers.","Unit-test the authority mapping of UserDetailsService/JWT converters.","Log principal authorities at auth time to compare against required attributes.","Review LoggerListener WARN output for systematic denial patterns."],"tags":["security","authorization","access-denied","event-listener"],"backgroundTag":"permission-denied","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}