{"record":{"id":"d3c21ed85ec4a227","repo":"spring-projects/spring-security","slug":"authenticationmanager-should-not-return-null-authe-d3c21e","errorCode":null,"errorMessage":"AuthenticationManager should not return null Authentication object.","messagePattern":"AuthenticationManager should not return null Authentication object\\.","errorType":"exception","errorClass":"ServletException","httpStatus":null,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/authentication/AuthenticationFilter.java","lineNumber":287,"sourceCode":"\tprivate void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,\n\t\t\tAuthentication authentication) throws IOException, ServletException {\n\t\tSecurityContext context = this.securityContextHolderStrategy.createEmptyContext();\n\t\tcontext.setAuthentication(authentication);\n\t\tthis.securityContextHolderStrategy.setContext(context);\n\t\tthis.securityContextRepository.saveContext(context, request, response);\n\t\tthis.successHandler.onAuthenticationSuccess(request, response, chain, authentication);\n\t}\n\n\tprivate @Nullable Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)\n\t\t\tthrows AuthenticationException, ServletException {\n\t\tAuthentication authentication = this.authenticationConverter.convert(request);\n\t\tif (authentication == null) {\n\t\t\treturn null;\n\t\t}\n\t\tAuthenticationManager authenticationManager = this.authenticationManagerResolver.resolve(request);\n\t\tAuthentication authenticationResult = authenticationManager.authenticate(authentication);\n\t\tif (authenticationResult == null) {\n\t\t\tthrow new ServletException(\"AuthenticationManager should not return null Authentication object.\");\n\t\t}\n\t\treturn authenticationResult;\n\t}\n\n}\n","sourceCodeStart":269,"sourceCodeEnd":293,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/authentication/AuthenticationFilter.java#L269-L293","documentation":"AuthenticationFilter.attemptAuthentication() resolves an AuthenticationManager per-request via AuthenticationManagerResolver, authenticates the converted token, and enforces the contract that authenticate() must not return null. A null result would silently drop authentication, so a ServletException is thrown. This is the request-delegating variant of the same invariant as AbstractAuthenticationProcessingFilter.","triggerScenarios":"A per-request AuthenticationManagerResolver resolves a manager (or lambda) whose authenticate() returns null for the token produced by the filter's AuthenticationConverter, during processing of a matched request.","commonSituations":"Multi-tenant apps using AuthenticationManagerResolver per tenant where one tenant's manager stub returns null; mock/stub managers in tests; custom resolvers returning a manager that swallows errors and returns null.","solutions":["Fix the resolved AuthenticationManager so authenticate() returns a non-null Authentication or throws AuthenticationException","Audit the AuthenticationManagerResolver: if a tenant/lookup is unknown, throw instead of returning a broken manager","Add a test asserting each resolvable manager never returns null"],"exampleFix":"// before\nresolver = request -> tenantManagerOrDefault(request); // may return manager yielding null\n// after\nresolver = request -> {\n    AuthenticationManager m = tenantManager(request);\n    if (m == null) throw new AuthenticationServiceException(\"No manager for tenant\");\n    return m;\n};","handlingStrategy":"validation","validationCode":"AuthenticationManager m = this.authenticationManagerResolver.resolve(request);\nAuthentication r = m.authenticate(token);\nif (r == null) throw new IllegalStateException(\"Resolved manager returned null\");","typeGuard":null,"tryCatchPattern":"try {\n    filter.doFilter(request, response, chain);\n} catch (ServletException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"should not return null\")) {\n        log.error(\"Per-request AuthenticationManager returned null\", e);\n    }\n    throw e;\n}","preventionTips":["Make every AuthenticationManagerResolver branch return a valid manager or throw","Test all tenants/branches of the resolver","Never stub managers to return null in tests"],"tags":["spring-security","authentication-manager","null-return","multi-tenant"],"backgroundTag":"null-argument","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}