spring-projects/spring-security · warning

Could not validate configuration attributes as the FilterInv

Error message

Could not validate configuration attributes as the FilterInvocationSecurityMetadataSource did not return any attributes

What it means

ChannelProcessingFilter.afterPropertiesSet() validates at startup that the security metadata source returns config attributes so it can warn about attributes the ChannelDecisionManager cannot handle. When FilterInvocationSecurityMetadataSource.getAllConfigAttributes() returns null (not an empty collection), the filter cannot perform this validation and logs this warning instead of failing. This is not fatal; it only means channel-security attribute consistency was not verified.

Source

Thrown at access/src/main/java/org/springframework/security/web/access/channel/ChannelProcessingFilter.java:104

 * @author Ben Alex
 * @deprecated see {@link org.springframework.security.web.transport.HttpsRedirectFilter}
 */
@Deprecated
public class ChannelProcessingFilter extends GenericFilterBean {

	@SuppressWarnings("NullAway.Init")
	private ChannelDecisionManager channelDecisionManager;

	@SuppressWarnings("NullAway.Init")
	private FilterInvocationSecurityMetadataSource securityMetadataSource;

	@Override
	public void afterPropertiesSet() {
		Assert.notNull(this.securityMetadataSource, "securityMetadataSource must be specified");
		Assert.notNull(this.channelDecisionManager, "channelDecisionManager must be specified");
		Collection<ConfigAttribute> attributes = this.securityMetadataSource.getAllConfigAttributes();
		if (attributes == null) {
			this.logger.warn("Could not validate configuration attributes as the "
					+ "FilterInvocationSecurityMetadataSource did not return any attributes");
			return;
		}
		Set<ConfigAttribute> unsupportedAttributes = getUnsupportedAttributes(attributes);
		Assert.isTrue(unsupportedAttributes.isEmpty(),
				() -> "Unsupported configuration attributes: " + unsupportedAttributes);
		this.logger.info("Validated configuration attributes");
	}

	private Set<ConfigAttribute> getUnsupportedAttributes(Collection<ConfigAttribute> attrDefs) {
		Set<ConfigAttribute> unsupportedAttributes = new HashSet<>();
		for (ConfigAttribute attr : attrDefs) {
			if (!this.channelDecisionManager.supports(attr)) {
				unsupportedAttributes.add(attr);
			}
		}
		return unsupportedAttributes;
	}

View on GitHub (pinned to 96852e8860)

Solutions

Have your FilterInvocationSecurityMetadataSource return an empty collection (e.g. Collections.emptyList() or the map's keySet) instead of null from getAllConfigAttributes().
If using DefaultFilterInvocationSecurityMetadataSource, ensure requestMap is non-null so getAllConfigAttributes() returns the attribute set.
If the null return is intentional and channel attributes are validated elsewhere, silence the warning with a specific logger level and document why.
Verify the ChannelProcessingFilter actually needs this metadata source; if channel security is unused, remove the filter bean.

Example fix

// before
@Override
public Collection<ConfigAttribute> getAllConfigAttributes() {
    return null;
}

// after
@Override
public Collection<ConfigAttribute> getAllConfigAttributes() {
    return Collections.emptyList();
}

Defensive patterns

Strategy: validation

Validate before calling

Collection<ConfigAttribute> attrs = metadataSource.getAllConfigAttributes();
if (attrs == null) {
    throw new IllegalStateException("FilterInvocationSecurityMetadataSource must return an empty collection, not null");
}

Prevention

Always return Collections.emptyList() from getAllConfigAttributes(), never null.
Unit-test custom MetadataSources asserting getAllConfigAttributes() != null.
Enable the ChannelProcessingFilter startup check in integration tests so warnings surface early.

When it happens

Trigger: A FilterInvocationSecurityMetadataSource (e.g. DefaultFilterInvocationSecurityMetadataSource built with no getAttributes entries) returns null from getAllConfigAttributes() while being wired into ChannelProcessingFilter, which then runs afterPropertiesSet() during bean initialization.

Common situations: Custom MetadataSource implementations that return null instead of an empty set; XML or Java config where the channel-security definitions were dropped or the <intercept-message> entries are missing; test setups (e.g. testDetectsSupportedConfigAttribute) that instantiate the filter without metadata.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/eb73ecdb524ebd65. Report an issue: GitHub.