{"record":{"id":"bc3893e6022ff423","repo":"spring-projects/spring-security","slug":"the-filter-class-registeredfilter-getname-does","errorCode":null,"errorMessage":"The Filter class {registeredFilter.getName()} does not have a registered order","messagePattern":"The Filter class (.+?) does not have a registered order","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java","lineNumber":1833,"sourceCode":"\n\tprivate AuthenticationManagerBuilder getAuthenticationRegistry() {\n\t\treturn getSharedObject(AuthenticationManagerBuilder.class);\n\t}\n\n\t@Override\n\tpublic HttpSecurity addFilterAfter(Filter filter, Class<? extends Filter> afterFilter) {\n\t\treturn addFilterAtOffsetOf(filter, 1, afterFilter);\n\t}\n\n\t@Override\n\tpublic HttpSecurity addFilterBefore(Filter filter, Class<? extends Filter> beforeFilter) {\n\t\treturn addFilterAtOffsetOf(filter, -1, beforeFilter);\n\t}\n\n\tprivate HttpSecurity addFilterAtOffsetOf(Filter filter, int offset, Class<? extends Filter> registeredFilter) {\n\t\tInteger registeredFilterOrder = this.filterOrders.getOrder(registeredFilter);\n\t\tif (registeredFilterOrder == null) {\n\t\t\tthrow new IllegalArgumentException(\n\t\t\t\t\t\"The Filter class \" + registeredFilter.getName() + \" does not have a registered order\");\n\t\t}\n\t\tint order = registeredFilterOrder + offset;\n\t\tthis.filters.add(new OrderedFilter(filter, order));\n\t\tthis.filterOrders.put(filter.getClass(), order);\n\t\treturn this;\n\t}\n\n\t@Override\n\tpublic HttpSecurity addFilter(Filter filter) {\n\t\tInteger order = this.filterOrders.getOrder(filter.getClass());\n\t\tif (order == null) {\n\t\t\tthrow new IllegalArgumentException(\"The Filter class \" + filter.getClass().getName()\n\t\t\t\t\t+ \" does not have a registered order and cannot be added without a specified order. Consider using addFilterBefore or addFilterAfter instead.\");\n\t\t}\n\t\tthis.filters.add(new OrderedFilter(filter, order));\n\t\treturn this;\n\t}","sourceCodeStart":1815,"sourceCodeEnd":1851,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java#L1815-L1851","documentation":"HttpSecurity.addFilterBefore/addFilterAfter/addFilterAt place a custom filter relative to an existing registered filter. If the reference filter class has no known position in HttpSecurity's internal filter-order registry, addFilterAtOffsetOf throws this IllegalArgumentException because an offset cannot be computed.","triggerScenarios":"Calling http.addFilterBefore(myFilter, SomeFilter.class) where SomeFilter (or the 'after'/'at' target) is not a standard Spring Security filter with a registered order; passing a custom filter class as the reference instead of a built-in one.","commonSituations":"Using addFilterBefore with another custom filter as the anchor; typos or custom subclasses of security filters whose class differs from the registered one; migrating filters that were never part of the default chain.","solutions":["Anchor the placement to a well-known Spring Security filter, e.g. addFilterBefore(f, UsernamePasswordAuthenticationFilter.class)","If you must reference a custom filter, first register it with a known order (e.g. addFilterAt with a standard filter, or use FilterComparator-equivalent registration)","Use addFilterAt with a built-in filter class when you want to occupy the same slot"],"exampleFix":"// before\nhttp.addFilterBefore(myFilter, MyCustomFilter.class);\n// after\nhttp.addFilterBefore(myFilter, UsernamePasswordAuthenticationFilter.class);","handlingStrategy":"validation","validationCode":"Class<? extends Filter> anchor = UsernamePasswordAuthenticationFilter.class; // must be a built-in security filter\nif (!(java.lang.reflect.Modifier.isPublic(anchor.getModifiers()))) { /* ... */ }\n// prefer: only pass classes from org.springframework.security.web.authentication.* etc. as anchors","typeGuard":"static boolean isKnownSecurityFilter(Class<? extends Filter> f) {\n    return f.getName().startsWith(\"org.springframework.security.web.\");\n}","tryCatchPattern":"try {\n    http.addFilterBefore(myFilter, anchorClass);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"does not have a registered order\")) {\n        http.addFilterBefore(myFilter, UsernamePasswordAuthenticationFilter.class);\n    } else throw e;\n}","preventionTips":["Only pass well-known Spring Security filter classes as addFilterBefore/After/At anchors","Never use your own custom filter class as the ordering reference","Keep custom filters extending OncePerRequestFilter but anchor them to built-in filters"],"tags":["spring-security","filter-chain","httpsecurity","configuration"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}