spring-projects/spring-security · error · IllegalStateException

Couldn't find FilterChainProxy in " + filters

Error message

Couldn't find FilterChainProxy in " + filters

What it means

findFilterChainProxy() scans the application's Filter list looking for the FilterChainProxy instance Spring Security registers (also unwrapping DebugFilter). This IllegalStateException is a configuration/bootstrap sanity check: it means the filter chain contains no FilterChainProxy at all, i.e. the Spring Security filter infrastructure was not registered as expected (for example springSecurityFilterChain is missing from the filter list). It is raised while CompositeFilterChainProxy initializes, so the security setup cannot proceed.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebMvcSecurityConfiguration.java:225

			return delegate;
		}

		/**
		 * Find the FilterChainProxy in a List of Filter.
		 * @param filters
		 * @return non-null FilterChainProxy
		 * @throws IllegalStateException if the FilterChainProxy cannot be found
		 */
		private static FilterChainProxy findFilterChainProxy(List<? extends Filter> filters) {
			for (Filter filter : filters) {
				if (filter instanceof FilterChainProxy fcp) {
					return fcp;
				}
				if (filter instanceof DebugFilter debugFilter) {
					return debugFilter.getFilterChainProxy();
				}
			}
			throw new IllegalStateException("Couldn't find FilterChainProxy in " + filters);
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Ensure Spring Security is configured via @EnableWebSecurity / WebSecurityConfiguration so the springSecurityFilterChain (FilterChainProxy) bean is created and registered as a filter
2. Verify the DelegatingFilterProxy registration includes the FilterChainProxy in the filter list passed to CompositeFilterChainProxy
3. If using Spring Security's DebugFilter, confirm it wraps a properly built FilterChainProxy rather than replacing it
4. Check that no custom filter configuration excludes or removes the security filter from the composite

When it happens

Trigger: Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebMvcSecurityConfiguration.java:225 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/61ab6d0682229ca1. Report an issue: GitHub.