{"record":{"id":"aab71127e6a91be2","repo":"spring-projects/spring-security","slug":"error-aab711","errorCode":null,"errorMessage":"\n\n********************************************************************\n**********        Security debugging is enabled.       *************\n**********    This may include sensitive information.  *************\n**********      Do not use in a production system!     *************\n********************************************************************\n\n","messagePattern":"\n\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*        Security debugging is enabled\\.       \\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*    This may include sensitive information\\.  \\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*      Do not use in a production system!     \\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/debug/SecurityDebugBeanFactoryPostProcessor.java","lineNumber":44,"sourceCode":"import org.springframework.beans.factory.support.BeanDefinitionRegistry;\nimport org.springframework.beans.factory.support.BeanDefinitionRegistryPostProcessor;\nimport org.springframework.security.config.BeanIds;\nimport org.springframework.security.web.debug.DebugFilter;\n\n/**\n * Wraps the {@code FilterChainProxy} bean definition with a {@link DebugFilter} to enable\n * security debugging.\n *\n * @author Luke Taylor\n * @author Rob Winch\n */\npublic class SecurityDebugBeanFactoryPostProcessor implements BeanDefinitionRegistryPostProcessor {\n\n\tprivate final Log logger = LogFactory.getLog(getClass());\n\n\t@Override\n\tpublic void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {\n\t\tthis.logger.warn(\"\\n\\n\" + \"********************************************************************\\n\"\n\t\t\t\t+ \"**********        Security debugging is enabled.       *************\\n\"\n\t\t\t\t+ \"**********    This may include sensitive information.  *************\\n\"\n\t\t\t\t+ \"**********      Do not use in a production system!     *************\\n\"\n\t\t\t\t+ \"********************************************************************\\n\\n\");\n\t\t// SPRING_SECURITY_FILTER_CHAIN does not exist yet since it is an alias that has\n\t\t// not been processed, so use FILTER_CHAIN_PROXY\n\t\tif (registry.containsBeanDefinition(BeanIds.FILTER_CHAIN_PROXY)) {\n\t\t\tBeanDefinition fcpBeanDef = registry.getBeanDefinition(BeanIds.FILTER_CHAIN_PROXY);\n\t\t\tBeanDefinitionBuilder debugFilterBldr = BeanDefinitionBuilder.genericBeanDefinition(DebugFilter.class);\n\t\t\tdebugFilterBldr.addConstructorArgValue(fcpBeanDef);\n\t\t\t// Remove the alias to SPRING_SECURITY_FILTER_CHAIN, so that it does not\n\t\t\t// override the new\n\t\t\t// SPRING_SECURITY_FILTER_CHAIN definition\n\t\t\tregistry.removeAlias(BeanIds.SPRING_SECURITY_FILTER_CHAIN);\n\t\t\tregistry.registerBeanDefinition(BeanIds.SPRING_SECURITY_FILTER_CHAIN, debugFilterBldr.getBeanDefinition());\n\t\t}\n\t}\n","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/debug/SecurityDebugBeanFactoryPostProcessor.java#L26-L62","documentation":"SecurityDebugBeanFactoryPostProcessor is registered when @EnableWebSecurity(debug = true) is used with the XML/bean-based setup. Its postProcessBeanDefinitionRegistry logs the same multi-line banner as WebSecurity, warning that security debugging is enabled, may leak sensitive information, and must not be used in production, before it swaps in debug-related bean definitions (e.g. wiring DebugFilter via FILTER_CHAIN_PROXY).","triggerScenarios":"Booting an application context where @EnableWebSecurity(debug = true) imported SecurityDebugBeanFactoryPostProcessor; the banner is logged once during bean-definition-registry post-processing at context startup.","commonSituations":"Debug flag left on after troubleshooting; XML-based security configs copied from dev environments; enabling debug to inspect the published filter chain and forgetting to turn it off before release builds.","solutions":["Remove debug = true (or set debug = false) from @EnableWebSecurity in production code paths.","Gate the debug config behind a dev-only profile or property so production contexts never register the post-processor.","Check built artifacts/config scanning to ensure no test or sample configuration with debug=true is component-scanned in production."],"exampleFix":"// before\n@EnableWebSecurity(debug = true)\n@Configuration\npublic class DebugSecurityConfig { }\n\n// after\n@Configuration\n@Profile({\"dev\", \"local\"})\n@EnableWebSecurity(debug = true)\npublic class DebugSecurityConfig { }","handlingStrategy":"validation","validationCode":"// Production context guard\nif (env.getActiveProfiles().length > 0 && Set.of(env.getActiveProfiles()).contains(\"prod\") && debugEnabled) {\n    throw new IllegalStateException(\"SecurityDebugBeanFactoryPostProcessor registered in production profile\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep debug-enabled configuration in dev-only profiles or separate modules not scanned in production.","Verify the deployed context does not include the debug post-processor bean.","Treat the startup banner as an alarm and roll back deployments that emit it."],"tags":["spring-security","debug","security-risk","production"],"backgroundTag":"debug-enabled-in-production","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}