{"record":{"id":"d6921d900fb4b434","repo":"spring-projects/spring-security","slug":"s-does-not-store-credentials","errorCode":null,"errorMessage":"%s does not store credentials","messagePattern":"(.+?) does not store credentials","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/core/Authentication.java","lineNumber":196,"sourceCode":"\t\t * @return the {@link Builder} for additional configuration\n\t\t * @see Authentication#getAuthorities\n\t\t */\n\t\tB authorities(Consumer<Collection<GrantedAuthority>> authorities);\n\n\t\t/**\n\t\t * Use this credential.\n\t\t * <p>\n\t\t * Note that since some credentials are insecure to store, this method is\n\t\t * implemented as unsupported by default. Only implement or use this method if you\n\t\t * support secure storage of the credential or if your implementation also\n\t\t * implements {@link CredentialsContainer} and the credentials are thereby erased.\n\t\t * </p>\n\t\t * @param credentials the credentials to use\n\t\t * @return the {@link Builder} for additional configuration\n\t\t * @see Authentication#getCredentials\n\t\t */\n\t\tdefault B credentials(@Nullable Object credentials) {\n\t\t\tthrow new UnsupportedOperationException(\n\t\t\t\t\tString.format(\"%s does not store credentials\", this.getClass().getSimpleName()));\n\t\t}\n\n\t\t/**\n\t\t * Use this details object.\n\t\t * <p>\n\t\t * Implementations may choose to use these {@code details} in combination with any\n\t\t * principal from the pre-existing {@link Authentication} instance.\n\t\t * </p>\n\t\t * @param details the details to use\n\t\t * @return the {@link Builder} for additional configuration\n\t\t * @see Authentication#getDetails\n\t\t */\n\t\tB details(@Nullable Object details);\n\n\t\t/**\n\t\t * Use this principal.\n\t\t * <p>","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/core/Authentication.java#L178-L214","documentation":"The default Authentication.Builder#credentials(Object) method throws UnsupportedOperationException('... does not store credentials') because that builder's Authentication implementation does not support holding credentials. Builders of credential-less Authentication types (e.g. pre-authenticated or token types that intentionally drop secrets) inherit this default and fail fast if credentials are set. [SOURCE context: core/src/main/java/org/springframework/security/core/Authentication.java:196]","triggerScenarios":"Calling .credentials(...) on a builder whose resulting Authentication class does not implement a credentials-capable builder (only overrides getCredentials semantics); copy-pasting builder code between Authentication types where one stores credentials and the other does not.","commonSituations":"Refactoring authentication code and reusing a builder chain across token types; framework upgrades introducing a default builder method that some Authentication implementations never supported; writing generic code that uniformly calls .credentials() on any Authentication.Builder.","solutions":["Stop calling .credentials() on builders for Authentication types that do not store credentials; put the secret only into the initial token constructor","Check the concrete Authentication/Builder class documentation (Javadoc on Authentication.Builder#credentials) to confirm credential support","If credential storage is needed, use or implement a builder that overrides credentials() with real storage"],"exampleFix":"// before\nMyToken t = SomeNonCredentialAuthentication.builder()\n        .principal(principal)\n        .credentials(secret) // throws\n        .build();\n// after\nMyToken t = new UsernamePasswordAuthenticationToken(principal, secret); // credential-capable type","handlingStrategy":"type-guard","validationCode":"if (!authenticationTypeStoresCredentials(builderClass)) { throw new IllegalArgumentException(\"this Authentication type does not support credentials()\"); }","typeGuard":"boolean supportsCredentials(Authentication.Builder b) { try { return !(b.getClass().getMethod(\"credentials\", Object.class).getDeclaringClass().equals(Authentication.Builder.class)); } catch (NoSuchMethodException e) { return false; } }","tryCatchPattern":"try { builder.credentials(secret); } catch (UnsupportedOperationException e) { throw new IllegalArgumentException(\"this authentication type does not store credentials\"); }","preventionTips":["Only call .credentials() on builders documented to store credentials","Pass secrets through the token constructor instead of a generic builder chain","Avoid generic helper methods that blindly call .credentials() on any Authentication.Builder"],"tags":["unsupported-operation","builder","spring-security"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}