{"record":{"id":"c7bc5ce9b792fc27","repo":"spring-projects/spring-security","slug":"one-of-the-patterns-in-s-is-missing-a-leading-sla","errorCode":null,"errorMessage":"One of the patterns in %s is missing a leading slash. This is discouraged; please include the leading slash in all your request matcher patterns. In future versions of Spring Security, leaving out the leading slash will result in an exception.","messagePattern":"One of the patterns in (.+?) is missing a leading slash\\. This is discouraged; please include the leading slash in all your request matcher patterns\\. In future versions of Spring Security, leaving out the leading slash will result in an exception\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java","lineNumber":141,"sourceCode":"\t/**\n\t * <p>\n\t * Match when the {@link HttpMethod} is {@code method} and when the request URI\n\t * matches one of {@code patterns}. See\n\t * {@link org.springframework.web.util.pattern.PathPattern} for matching rules.\n\t * </p>\n\t * <p>\n\t * If a specific {@link RequestMatcher} must be specified, use\n\t * {@link #requestMatchers(RequestMatcher...)} instead\n\t * </p>\n\t * @param method the {@link HttpMethod} to use or {@code null} for any\n\t * {@link HttpMethod}.\n\t * @param patterns the patterns to match on\n\t * @return the object that is chained after creating the {@link RequestMatcher}.\n\t * @since 5.8\n\t */\n\tpublic C requestMatchers(HttpMethod method, String... patterns) {\n\t\tif (anyPathsDontStartWithLeadingSlash(patterns)) {\n\t\t\tthis.logger.warn(\"One of the patterns in \" + Arrays.toString(patterns)\n\t\t\t\t\t+ \" is missing a leading slash. This is discouraged; please include the \"\n\t\t\t\t\t+ \"leading slash in all your request matcher patterns. In future versions of \"\n\t\t\t\t\t+ \"Spring Security, leaving out the leading slash will result in an exception.\");\n\t\t}\n\t\tAssert.state(!this.anyRequestConfigured, \"Can't configure requestMatchers after anyRequest\");\n\t\tPathPatternRequestMatcher.Builder builder = getRequestMatcherBuilder();\n\t\tList<RequestMatcher> matchers = new ArrayList<>();\n\t\tfor (String pattern : patterns) {\n\t\t\tmatchers.add(builder.matcher(method, pattern));\n\t\t}\n\t\treturn requestMatchers(matchers.toArray(new RequestMatcher[0]));\n\t}\n\n\tprivate PathPatternRequestMatcher.Builder getRequestMatcherBuilder() {\n\t\tif (this.requestMatcherBuilder != null) {\n\t\t\treturn this.requestMatcherBuilder;\n\t\t}\n\t\tthis.requestMatcherBuilder = this.context.getBeanProvider(PathPatternRequestMatcher.Builder.class)","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java#L123-L159","documentation":"AbstractRequestMatcherRegistry.requestMatchers(HttpMethod, String...) warns when one or more supplied URL patterns do not start with '/'. Spring Security historically tolerated this, but patterns without a leading slash are ambiguous with MVC handler matching and will throw an exception in a future release, so the registry nudges developers to fix patterns now.","triggerScenarios":"Calling http.authorizeHttpRequests(a -> a.requestMatchers(HttpMethod.GET, \"login\").permitAll()) (or any configurer that routes through requestMatchers) with a pattern lacking the leading '/', while anyRequest has not yet been configured.","commonSituations":"Copying patterns from controllers ('/login' annotated paths) without the slash; older XML-style antPatterns like 'admin/**' migrated to requestMatchers; typos where the slash was dropped during refactoring to Spring Security 5.8+/6.","solutions":["Prefix every pattern with '/' in the requestMatchers(...) call.","Run the app once in dev; the warning names the offending patterns array — fix each listed one before upgrading Spring Security.","If patterns come from configuration/properties, validate at load time that each starts with '/'."],"exampleFix":"// before\nhttp.authorizeHttpRequests(a -> a.requestMatchers(HttpMethod.POST, \"api/users\").permitAll());\n\n// after\nhttp.authorizeHttpRequests(a -> a.requestMatchers(HttpMethod.POST, \"/api/users\").permitAll());","handlingStrategy":"validation","validationCode":"for (String p : patterns) {\n    if (!p.startsWith(\"/\")) {\n        throw new IllegalArgumentException(\"Pattern must start with '/': \" + p);\n    }\n}\nhttp.authorizeHttpRequests(a -> a.requestMatchers(HttpMethod.GET, patterns));","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write patterns as absolute paths beginning with '/'.","Centralize URL constants so slashes are not lost at call sites.","Check startup logs for this warning after every Spring Security upgrade and fix before the future exception lands."],"tags":["spring-security","url-patterns","deprecation","migration"],"backgroundTag":"missing-leading-slash","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}