{"record":{"id":"c3469181b428daa6","repo":"spring-projects/spring-security","slug":"switchuserfilter-nocurrentuser","errorCode":"SwitchUserFilter.noCurrentUser","errorMessage":"No current user associated with this request","messagePattern":"No current user associated with this request","errorType":"exception","errorClass":"AuthenticationCredentialsNotFoundException","httpStatus":null,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.java","lineNumber":267,"sourceCode":"\t\t\t}\n\t\t}\n\t\treturn targetUserRequest;\n\t}\n\n\t/**\n\t * Attempt to exit from an already switched user.\n\t * @param request The http servlet request\n\t * @return The original <code>Authentication</code> object or <code>null</code>\n\t * otherwise.\n\t * @throws AuthenticationCredentialsNotFoundException If no\n\t * <code>Authentication</code> associated with this request.\n\t */\n\tprotected Authentication attemptExitUser(HttpServletRequest request)\n\t\t\tthrows AuthenticationCredentialsNotFoundException {\n\t\t// need to check to see if the current user has a SwitchUserGrantedAuthority\n\t\tAuthentication current = this.securityContextHolderStrategy.getContext().getAuthentication();\n\t\tif (current == null) {\n\t\t\tthrow new AuthenticationCredentialsNotFoundException(this.messages\n\t\t\t\t.getMessage(\"SwitchUserFilter.noCurrentUser\", \"No current user associated with this request\"));\n\t\t}\n\t\t// check to see if the current user did actual switch to another user\n\t\t// if so, get the original source user so we can switch back\n\t\tAuthentication original = getSourceAuthentication(current);\n\t\tif (original == null) {\n\t\t\tthis.logger.debug(\"Failed to find original user\");\n\t\t\tthrow new AuthenticationCredentialsNotFoundException(this.messages\n\t\t\t\t.getMessage(\"SwitchUserFilter.noOriginalAuthentication\", \"Failed to find original user\"));\n\t\t}\n\t\t// get the source user details\n\t\tUserDetails originalUser = null;\n\t\tObject obj = original.getPrincipal();\n\t\tif ((obj != null) && obj instanceof UserDetails) {\n\t\t\toriginalUser = (UserDetails) obj;\n\t\t}\n\t\t// publish event\n\t\tif (this.eventPublisher != null) {","sourceCodeStart":249,"sourceCodeEnd":285,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.java#L249-L285","documentation":"SwitchUserFilter.attemptExitUser needs the current Authentication to find the original user stored in a SwitchUserGrantedAuthority. If the SecurityContext holds no Authentication, it throws AuthenticationCredentialsNotFoundException mapped from message code SwitchUserFilter.noCurrentUser. You cannot switch back to a user when there is no current user at all.","triggerScenarios":"A request hits the exit-user URL (default /logout/impersonate) while SecurityContextHolder.getContext().getAuthentication() returns null — e.g. no session, expired session, or the filter runs before authentication is established.","commonSituations":"User's session expired while impersonating, then clicks 'switch back'; exit URL hit directly without an authenticated session; security context cleared by concurrent logout; misconfigured filter order so the switch-user filter sees no authentication.","solutions":["Redirect unauthenticated users to the login page before exposing the switch-back link","Render the 'exit impersonation' link only when the current authentication exists and contains a SwitchUserGrantedAuthority","Check filter ordering so authentication is established before SwitchUserFilter processes the exit request","Increase session timeout or warn users before session expiry during impersonation"],"exampleFix":"// before (link always rendered)\n<a th:href=\"@{/logout/impersonate}\">Switch back</a>\n// after (only when switched)\n<a th:if=\"${#authorization != null and #authentication.authorities.?[authority.startsWith('ROLE_PREVIOUS_AUTHENTICATION')].size() > 0}\"\n   th:href=\"@{/logout/impersonate}\">Switch back</a>","handlingStrategy":"try-catch","validationCode":"Authentication auth = SecurityContextHolder.getContext().getAuthentication();\nif (auth == null || !auth.isAuthenticated()) {\n    response.sendRedirect(\"/login\");\n    return; // skip switch-back handling entirely\n}","typeGuard":"boolean hasCurrentUser(Authentication a) {\n    return a != null && a.isAuthenticated() && !(a instanceof AnonymousAuthenticationToken);\n}","tryCatchPattern":"try {\n    filter.doFilter(request, response);\n} catch (AuthenticationCredentialsNotFoundException e) {\n    if (request.getRequestURI().equals(\"/logout/impersonate\")) {\n        response.sendRedirect(\"/login\");\n        return;\n    }\n    throw e;\n}","preventionTips":["Render the switch-back link only for users holding SwitchUserGrantedAuthority","Redirect to login when the session has expired","Verify filter order places authentication before SwitchUserFilter","Warn users of session timeout during impersonation"],"tags":["spring-security","switch-user","impersonation","session"],"backgroundTag":"authentication-required","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}