{"record":{"id":"abf15f5887cd2d38","repo":"spring-projects/spring-security","slug":"duplicate-url-defined-s-the-original-attribute","errorCode":null,"errorMessage":"Duplicate URL defined: %s. The original attribute values will be overwritten","messagePattern":"Duplicate URL defined: (.+?)\\. The original attribute values will be overwritten","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java","lineNumber":184,"sourceCode":"\t\t\t\t\t\t\turlElt);\n\t\t\t}\n\t\t\tBeanMetadataElement matcher = hasMatcherRef ? new RuntimeBeanReference(matcherRef)\n\t\t\t\t\t: matcherType.createMatcher(parserContext, path, method, servletPath);\n\t\t\tBeanDefinitionBuilder attributeBuilder = BeanDefinitionBuilder.rootBeanDefinition(SecurityConfig.class);\n\t\t\tif (useExpressions) {\n\t\t\t\tlogger.info(\"Creating access control expression attribute '\" + access + \"' for \" + path);\n\t\t\t\t// The single expression will be parsed later by the\n\t\t\t\t// ExpressionBasedFilterInvocationSecurityMetadataSource\n\t\t\t\tattributeBuilder.addConstructorArgValue(new String[] { access });\n\t\t\t\tattributeBuilder.setFactoryMethod(\"createList\");\n\n\t\t\t}\n\t\t\telse {\n\t\t\t\tattributeBuilder.addConstructorArgValue(access);\n\t\t\t\tattributeBuilder.setFactoryMethod(\"createListFromCommaDelimitedString\");\n\t\t\t}\n\t\t\tif (filterInvocationDefinitionMap.containsKey(matcher)) {\n\t\t\t\tlogger.warn(\"Duplicate URL defined: \" + path + \". The original attribute values will be overwritten\");\n\t\t\t}\n\t\t\tfilterInvocationDefinitionMap.put(matcher, attributeBuilder.getBeanDefinition());\n\t\t}\n\t\tif (addAuthenticatedAll && filterInvocationDefinitionMap.isEmpty()) {\n\t\t\tBeanDefinition matcher = matcherType.createMatcher(parserContext, \"/**\", null);\n\t\t\tBeanDefinitionBuilder attributeBuilder = BeanDefinitionBuilder.rootBeanDefinition(SecurityConfig.class);\n\t\t\tattributeBuilder.addConstructorArgValue(new String[] { \"authenticated\" });\n\t\t\tattributeBuilder.setFactoryMethod(\"createList\");\n\t\t\tfilterInvocationDefinitionMap.put(matcher, attributeBuilder.getBeanDefinition());\n\t\t}\n\t\treturn filterInvocationDefinitionMap;\n\t}\n\n\tstatic class DefaultWebSecurityExpressionHandlerBeanFactory\n\t\t\textends GrantedAuthorityDefaultsParserUtils.AbstractGrantedAuthorityDefaultsBeanFactory {\n\n\t\tprivate DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();\n","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java#L166-L202","documentation":"FilterInvocationSecurityMetadataSourceParser builds a URL-to-attributes map from <intercept-url> entries. When the same URL/pattern is defined more than once, the later definition silently replaces the earlier one, so a warning is logged to surface the likely config mistake.","triggerScenarios":"Two or more <intercept-url pattern=\"...\" access=\"...\"/> elements with identical patterns in the same <http> block, parsed via parseInterceptUrlsForFilterInvocationRequestMap.","commonSituations":"Copy-pasted intercept-url rules; includes/merged XML configs redefining the same pattern; refactoring leaves duplicate patterns with conflicting access attributes.","solutions":["Remove the duplicate <intercept-url> entry and keep the single intended rule","Reorder and merge access attributes into one rule per pattern","Migrate to authorizeHttpRequests where duplicate matchers surface as clearer ordering-based behavior"],"exampleFix":"<!-- before -->\n<intercept-url pattern=\"/admin/**\" access=\"hasRole('USER')\"/>\n<intercept-url pattern=\"/admin/**\" access=\"hasRole('ADMIN')\"/>\n<!-- after -->\n<intercept-url pattern=\"/admin/**\" access=\"hasRole('ADMIN')\"/>","handlingStrategy":"validation","validationCode":"// Parse intercept-url patterns and assert uniqueness before loading context\nSet<String> seen = new HashSet<>();\nfor (String p : interceptUrlPatterns) {\n  if (!seen.add(p)) throw new IllegalStateException(\"Duplicate pattern: \" + p);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep one rule per URL pattern; merge access attributes instead of duplicating entries","Review merged/included XML configs for overlapping patterns","Add a config lint or test that fails on duplicate intercept-url patterns"],"tags":["spring-security","xml-config","duplicate-config","intercept-url"],"backgroundTag":"conflicting-config-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}