spring-projects/spring-security · error · AuthenticationCredentialsNotFoundException

An Authentication object was not found in the SecurityContex

Error message

An Authentication object was not found in the SecurityContext

What it means

AuthorizationChannelInterceptor.getAuthentication() builds the authentication Supplier lazily. If the SecurityContextHolderStrategy's context contains no Authentication object when a message send is being authorized, it throws AuthenticationCredentialsNotFoundException('An Authentication object was not found in the SecurityContext').

Source

Thrown at messaging/src/main/java/org/springframework/security/messaging/access/intercept/AuthorizationChannelInterceptor.java:103

	public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
		this.authentication = getAuthentication(securityContextHolderStrategy);
	}

	/**
	 * Use this {@link AuthorizationEventPublisher} to publish the
	 * {@link AuthorizationManager} result.
	 * @param eventPublisher
	 */
	public void setAuthorizationEventPublisher(AuthorizationEventPublisher eventPublisher) {
		Assert.notNull(eventPublisher, "eventPublisher cannot be null");
		this.eventPublisher = eventPublisher;
	}

	private Supplier<Authentication> getAuthentication(SecurityContextHolderStrategy strategy) {
		return () -> {
			Authentication authentication = strategy.getContext().getAuthentication();
			if (authentication == null) {
				throw new AuthenticationCredentialsNotFoundException(
						"An Authentication object was not found in the SecurityContext");
			}
			return authentication;
		};
	}

	private static class NoopAuthorizationEventPublisher implements AuthorizationEventPublisher {

		@Override
		public <T> void publishAuthorizationEvent(Supplier<Authentication> authentication, T object,
				@Nullable AuthorizationResult result) {

		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Secure the STOMP CONNECT so authentication is established (enableInbound + authentication on the connect message, e.g. with an AuthenticationInterceptor or CSRF-token session binding).
2. Enable anonymous authentication (AnonymousAuthenticationFilter / setAnonymousAuthentication) so unauthenticated channels carry a non-null Authentication.
3. Ensure SecurityContext is propagated to the message-handling thread (use the channel interceptors provided by spring-security-messaging).
4. Client-side: always complete CONNECT/auth handshake before sending messages to protected destinations.

Example fix

// before: anonymous disabled -> null authentication on channel thread
http.anonymous().disable();
// after: allow anonymous principal for messaging authorization
http.anonymous().principal("guest").authorities("ROLE_ANONYMOUS");

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
if (auth == null) {
    throw new MessagingException("Authenticate via CONNECT before sending messages");
}

boolean isAuthenticated() {
    Authentication a = SecurityContextHolder.getContext().getAuthentication();
    return a != null && a.isAuthenticated() && !(a instanceof AnonymousAuthenticationToken);
}

try {
    channel.send(message);
} catch (MessageDeliveryException e)
    if (e.getCause() instanceof AuthenticationCredentialsNotFoundException) {
        // session not authenticated; redirect client to CONNECT/login
    }
}

When it happens

Trigger: A STOMP message arrives for authorization while SecurityContextHolder.getContext().getAuthentication() returns null — e.g. an unauthenticated CONNECT, authentication not propagated to the channel thread, or setSecurityContextHolderStrategy called with a strategy whose context has no auth.

Common situations: WebSocket CONNECT not secured (no spring-security-messaging integration on the inbound channel), so no user is bound before sends; anonymous authentication disabled so unauthenticated sessions carry null; client sends messages before CONNECT completes.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authenticated principal required to operate with ACLs
• Access Denied
• RunAsImplAuthenticationProvider.incorrectKey
• CasAuthenticationProvider.incorrectKey
• oidc_provider_not_configured

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/f9d5ad7b43340290. Report an issue: GitHub.