spring-projects/spring-security · warning
Authentication event %s: %s; details: %s; exception: %s
Error message
Authentication event %s: %s; details: %s; exception: %s
What it means
LoggerListener is an application listener that logs every AbstractAuthenticationEvent (success or failure) at warn level, including event class, result, authentication details, and any exception. It is a diagnostic aid for auditing authentication flows, not an error condition itself.
Source
Thrown at core/src/main/java/org/springframework/security/authentication/event/LoggerListener.java:48
*
* @author Ben Alex
*/
public class LoggerListener implements ApplicationListener<AbstractAuthenticationEvent> {
private static final Log logger = LogFactory.getLog(LoggerListener.class);
/**
* If set to true, {@link InteractiveAuthenticationSuccessEvent} will be logged
* (defaults to true).
*/
private boolean logInteractiveAuthenticationSuccessEvents = true;
@Override
public void onApplicationEvent(AbstractAuthenticationEvent event) {
if (!this.logInteractiveAuthenticationSuccessEvents && event instanceof InteractiveAuthenticationSuccessEvent) {
return;
}
logger.warn(LogMessage.of(() -> getLogMessage(event)));
}
private String getLogMessage(AbstractAuthenticationEvent event) {
StringBuilder builder = new StringBuilder();
builder.append("Authentication event ");
builder.append(ClassUtils.getShortName(event.getClass()));
builder.append(": ");
builder.append(event.getAuthentication().getName());
builder.append("; details: ");
builder.append(event.getAuthentication().getDetails());
if (event instanceof AbstractAuthenticationFailureEvent) {
builder.append("; exception: ");
builder.append(((AbstractAuthenticationFailureEvent) event).getException().getMessage());
}
return builder.toString();
}
public boolean isLogInteractiveAuthenticationSuccessEvents() {View on GitHub (pinned to 96852e8860)
Solutions
- Inspect the 'exception' field in the logged message to identify the actual authentication failure cause
- Remove the LoggerListener bean or lower log verbosity if these warnings are unwanted in production
- Configure logInteractiveAuthenticationSuccessEvents=false to suppress interactive success event noise
Defensive patterns
Strategy: fallback
Prevention
- Register LoggerListener only in environments where authentication audit logging is wanted
- Route org.springframework.security logs to an audit appender instead of default warn noise
- Parse the 'exception' field of the message to triage login failures (bad credentials, locked, expired)
When it happens
Trigger: LoggerListener is registered as a bean and any authentication event is published: AbstractAuthenticationFailureEvent, AuthenticationSuccessEvent, or (if enabled) InteractiveAuthenticationSuccessEvent via onApplicationEvent.
Common situations: Troubleshooting failed logins; auditing authentication in logs; seeing this line when investigating why a login failed (the embedded exception names the cause like BadCredentialsException).
Understand the failure class
- Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.
Related errors
- Could not validate configuration attributes as the FilterInv
- Global AuthenticationManager configured with an Authenticati
- Access is denied
- RunAsImplAuthenticationProvider.incorrectKey
- Access is denied
AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10).
Data as JSON: /api/errors/92cc0d55f2454944.
Report an issue: GitHub.