spring-projects/spring-security · error · IllegalStateException

Couldn't find FilterChainProxy in " + filters

Error message

Couldn't find FilterChainProxy in " + filters

What it means

findFilterChainProxy() walks the configured Filter list to locate the FilterChainProxy Spring Security registered (looking inside DebugFilter too). This IllegalStateException fires when no FilterChainProxy exists in that list, meaning the Spring Security filter chain bean (springSecurityFilterChain) was never added or was replaced by custom filter configuration. It is a fail-fast integrity check during security filter-chain construction; without a FilterChainProxy the firewall/delegate behavior cannot be established.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java:397

			return delegate;
		}

		/**
		 * Find the FilterChainProxy in a List of Filter.
		 * @param filters
		 * @return non-null FilterChainProxy
		 * @throws IllegalStateException if the FilterChainProxy cannot be found
		 */
		private static FilterChainProxy findFilterChainProxy(List<? extends Filter> filters) {
			for (Filter filter : filters) {
				if (filter instanceof FilterChainProxy fcp) {
					return fcp;
				}
				if (filter instanceof DebugFilter debugFilter) {
					return debugFilter.getFilterChainProxy();
				}
			}
			throw new IllegalStateException("Couldn't find FilterChainProxy in " + filters);
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Ensure Spring Security's @EnableWebSecurity configuration is present so the FilterChainProxy (springSecurityFilterChain) bean exists and is in the filter list
2. Verify custom Filter registrations did not remove or replace the security filter chain
3. If a DebugFilter is used, confirm it wraps the actual FilterChainProxy

When it happens

Trigger: Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java:397 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/c8184e8bbc4d4efa. Report an issue: GitHub.