spring-projects/spring-security · error · ServletException

AuthenticationManager should not return null Authentication…

Error message

AuthenticationManager should not return null Authentication object.

What it means

AuthenticationFilter.attemptAuthentication() resolves an AuthenticationManager per-request via AuthenticationManagerResolver, authenticates the converted token, and enforces the contract that authenticate() must not return null. A null result would silently drop authentication, so a ServletException is thrown. This is the request-delegating variant of the same invariant as AbstractAuthenticationProcessingFilter.

Solutions

Fix the resolved AuthenticationManager so authenticate() returns a non-null Authentication or throws AuthenticationException
Audit the AuthenticationManagerResolver: if a tenant/lookup is unknown, throw instead of returning a broken manager
Add a test asserting each resolvable manager never returns null

Example fix

// before
resolver = request -> tenantManagerOrDefault(request); // may return manager yielding null
// after
resolver = request -> {
    AuthenticationManager m = tenantManager(request);
    if (m == null) throw new AuthenticationServiceException("No manager for tenant");
    return m;
};

Defensive patterns

Strategy: validation

Validate before calling

AuthenticationManager m = this.authenticationManagerResolver.resolve(request);
Authentication r = m.authenticate(token);
if (r == null) throw new IllegalStateException("Resolved manager returned null");

Try / catch

try {
    filter.doFilter(request, response, chain);
} catch (ServletException e) {
    if (e.getMessage() != null && e.getMessage().contains("should not return null")) {
        log.error("Per-request AuthenticationManager returned null", e);
    }
    throw e;
}

Prevention

Make every AuthenticationManagerResolver branch return a valid manager or throw
Test all tenants/branches of the resolver
Never stub managers to return null in tests

When it happens

Trigger: A per-request AuthenticationManagerResolver resolves a manager (or lambda) whose authenticate() returns null for the token produced by the filter's AuthenticationConverter, during processing of a matched request.

Common situations: Multi-tenant apps using AuthenticationManagerResolver per tenant where one tenant's manager stub returns null; mock/stub managers in tests; custom resolvers returning a manager that swallows errors and returns null.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/d3c21ed85ec4a227. Report an issue: GitHub.

Appendix: source

Thrown at web/src/main/java/org/springframework/security/web/authentication/AuthenticationFilter.java:287

	private void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
			Authentication authentication) throws IOException, ServletException {
		SecurityContext context = this.securityContextHolderStrategy.createEmptyContext();
		context.setAuthentication(authentication);
		this.securityContextHolderStrategy.setContext(context);
		this.securityContextRepository.saveContext(context, request, response);
		this.successHandler.onAuthenticationSuccess(request, response, chain, authentication);
	}

	private @Nullable Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
			throws AuthenticationException, ServletException {
		Authentication authentication = this.authenticationConverter.convert(request);
		if (authentication == null) {
			return null;
		}
		AuthenticationManager authenticationManager = this.authenticationManagerResolver.resolve(request);
		Authentication authenticationResult = authenticationManager.authenticate(authentication);
		if (authenticationResult == null) {
			throw new ServletException("AuthenticationManager should not return null Authentication object.");
		}
		return authenticationResult;
	}

}

View on GitHub (pinned to 96852e8860)