{"record":{"id":"eb73ecdb524ebd65","repo":"spring-projects/spring-security","slug":"could-not-validate-configuration-attributes-as-the-eb73ec","errorCode":null,"errorMessage":"Could not validate configuration attributes as the FilterInvocationSecurityMetadataSource did not return any attributes","messagePattern":"Could not validate configuration attributes as the FilterInvocationSecurityMetadataSource did not return any attributes","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"access/src/main/java/org/springframework/security/web/access/channel/ChannelProcessingFilter.java","lineNumber":104,"sourceCode":" * @author Ben Alex\n * @deprecated see {@link org.springframework.security.web.transport.HttpsRedirectFilter}\n */\n@Deprecated\npublic class ChannelProcessingFilter extends GenericFilterBean {\n\n\t@SuppressWarnings(\"NullAway.Init\")\n\tprivate ChannelDecisionManager channelDecisionManager;\n\n\t@SuppressWarnings(\"NullAway.Init\")\n\tprivate FilterInvocationSecurityMetadataSource securityMetadataSource;\n\n\t@Override\n\tpublic void afterPropertiesSet() {\n\t\tAssert.notNull(this.securityMetadataSource, \"securityMetadataSource must be specified\");\n\t\tAssert.notNull(this.channelDecisionManager, \"channelDecisionManager must be specified\");\n\t\tCollection<ConfigAttribute> attributes = this.securityMetadataSource.getAllConfigAttributes();\n\t\tif (attributes == null) {\n\t\t\tthis.logger.warn(\"Could not validate configuration attributes as the \"\n\t\t\t\t\t+ \"FilterInvocationSecurityMetadataSource did not return any attributes\");\n\t\t\treturn;\n\t\t}\n\t\tSet<ConfigAttribute> unsupportedAttributes = getUnsupportedAttributes(attributes);\n\t\tAssert.isTrue(unsupportedAttributes.isEmpty(),\n\t\t\t\t() -> \"Unsupported configuration attributes: \" + unsupportedAttributes);\n\t\tthis.logger.info(\"Validated configuration attributes\");\n\t}\n\n\tprivate Set<ConfigAttribute> getUnsupportedAttributes(Collection<ConfigAttribute> attrDefs) {\n\t\tSet<ConfigAttribute> unsupportedAttributes = new HashSet<>();\n\t\tfor (ConfigAttribute attr : attrDefs) {\n\t\t\tif (!this.channelDecisionManager.supports(attr)) {\n\t\t\t\tunsupportedAttributes.add(attr);\n\t\t\t}\n\t\t}\n\t\treturn unsupportedAttributes;\n\t}","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/access/src/main/java/org/springframework/security/web/access/channel/ChannelProcessingFilter.java#L86-L122","documentation":"ChannelProcessingFilter.afterPropertiesSet() validates at startup that the security metadata source returns config attributes so it can warn about attributes the ChannelDecisionManager cannot handle. When FilterInvocationSecurityMetadataSource.getAllConfigAttributes() returns null (not an empty collection), the filter cannot perform this validation and logs this warning instead of failing. This is not fatal; it only means channel-security attribute consistency was not verified.","triggerScenarios":"A FilterInvocationSecurityMetadataSource (e.g. DefaultFilterInvocationSecurityMetadataSource built with no getAttributes entries) returns null from getAllConfigAttributes() while being wired into ChannelProcessingFilter, which then runs afterPropertiesSet() during bean initialization.","commonSituations":"Custom MetadataSource implementations that return null instead of an empty set; XML or Java config where the channel-security definitions were dropped or the <intercept-message> entries are missing; test setups (e.g. testDetectsSupportedConfigAttribute) that instantiate the filter without metadata.","solutions":["Have your FilterInvocationSecurityMetadataSource return an empty collection (e.g. Collections.emptyList() or the map's keySet) instead of null from getAllConfigAttributes().","If using DefaultFilterInvocationSecurityMetadataSource, ensure requestMap is non-null so getAllConfigAttributes() returns the attribute set.","If the null return is intentional and channel attributes are validated elsewhere, silence the warning with a specific logger level and document why.","Verify the ChannelProcessingFilter actually needs this metadata source; if channel security is unused, remove the filter bean."],"exampleFix":"// before\n@Override\npublic Collection<ConfigAttribute> getAllConfigAttributes() {\n    return null;\n}\n\n// after\n@Override\npublic Collection<ConfigAttribute> getAllConfigAttributes() {\n    return Collections.emptyList();\n}","handlingStrategy":"validation","validationCode":"Collection<ConfigAttribute> attrs = metadataSource.getAllConfigAttributes();\nif (attrs == null) {\n    throw new IllegalStateException(\"FilterInvocationSecurityMetadataSource must return an empty collection, not null\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always return Collections.emptyList() from getAllConfigAttributes(), never null.","Unit-test custom MetadataSources asserting getAllConfigAttributes() != null.","Enable the ChannelProcessingFilter startup check in integration tests so warnings surface early."],"tags":["spring-security","filter-startup","config-attributes","logging"],"backgroundTag":"invalid-config-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}