{"record":{"id":"c65d948cc16ddda8","repo":"spring-projects/spring-security","slug":"access-is-denied-c65d94","errorCode":null,"errorMessage":"Access is denied","messagePattern":"Access is denied","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"access/src/main/java/org/springframework/security/access/vote/AbstractAccessDecisionManager.java","lineNumber":71,"sourceCode":"\n\tprotected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();\n\n\tprivate boolean allowIfAllAbstainDecisions = false;\n\n\tprotected AbstractAccessDecisionManager(List<AccessDecisionVoter<?>> decisionVoters) {\n\t\tAssert.notEmpty(decisionVoters, \"A list of AccessDecisionVoters is required\");\n\t\tthis.decisionVoters = decisionVoters;\n\t}\n\n\t@Override\n\tpublic void afterPropertiesSet() {\n\t\tAssert.notEmpty(this.decisionVoters, \"A list of AccessDecisionVoters is required\");\n\t\tAssert.notNull(this.messages, \"A message source must be set\");\n\t}\n\n\tprotected final void checkAllowIfAllAbstainDecisions() {\n\t\tif (!this.isAllowIfAllAbstainDecisions()) {\n\t\t\tthrow new AccessDeniedException(\n\t\t\t\t\tthis.messages.getMessage(\"AbstractAccessDecisionManager.accessDenied\", \"Access is denied\"));\n\t\t}\n\t}\n\n\tpublic List<AccessDecisionVoter<?>> getDecisionVoters() {\n\t\treturn this.decisionVoters;\n\t}\n\n\tpublic boolean isAllowIfAllAbstainDecisions() {\n\t\treturn this.allowIfAllAbstainDecisions;\n\t}\n\n\tpublic void setAllowIfAllAbstainDecisions(boolean allowIfAllAbstainDecisions) {\n\t\tthis.allowIfAllAbstainDecisions = allowIfAllAbstainDecisions;\n\t}\n\n\t@Override\n\tpublic void setMessageSource(MessageSource messageSource) {","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/access/src/main/java/org/springframework/security/access/vote/AbstractAccessDecisionManager.java#L53-L89","documentation":"AbstractAccessDecisionManager.checkAllowIfAllAbstainDecisions() throws AccessDeniedException when every AccessDecisionVoter abstained and the 'allowIfAllAbstainDecisions' flag is false. Default security posture: abstention means deny.","triggerScenarios":"decide() on AffirmativeBased/ConsensusBased/UnanimousBased completes with zero grant/deny votes and allowIfAllAbstainDecisions (default false) denies; e.g. no voter has a config attribute matching the secured method's attributes.","commonSituations":"Method security annotations whose attributes no voter recognizes (e.g. ROLE_ prefix mismatch, missing RoleVoter), empty voter list, or custom voter abstaining because ConfigAttribute is unsupported.","solutions":["Set allowIfAllAbstainDecisions(true) on the decision manager if abstain should grant","Fix voter configuration so the relevant attributes are actually voted on (check RolePrefix, supported attribute types)","Ensure the secured invocation carries config attributes your voters understand","Add or register the appropriate voters (RoleVoter, AuthenticatedVoter, etc.)"],"exampleFix":"// before\nAffirmativeBased am = new AffirmativeBased(voters);\n// abstentions denied\n\n// after\nAffirmativeBased am = new AffirmativeBased(voters);\nam.setAllowIfAllAbstainDecisions(true);","handlingStrategy":"validation","validationCode":"if (voters.stream().noneMatch(v -> v.supports(configAttribute))) {\n    throw new IllegalStateException(\"No voter supports attribute \" + configAttribute);\n}","typeGuard":"null","tryCatchPattern":"try {\n    decisionManager.decide(auth, object, attrs);\n} catch (AccessDeniedException e) {\n    log.debug(\"All voters abstained and abstain-grant is disabled\");\n    throw e;\n}","preventionTips":["Check that every securing attribute is supported by at least one voter","Explicitly set allowIfAllAbstainDecisions to document intent","Keep voter lists non-empty and reviewed"],"tags":["spring-security","authorization","voters","access-decision","access-denied"],"backgroundTag":"permission-denied","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}