spring-projects/spring-security · warning

**********************************************************

Error message

********************************************************************
**********        Security debugging is enabled.       *************
**********    This may include sensitive information.  *************
**********      Do not use in a production system!     *************
********************************************************************

What it means

When debug support is on, WebSecurity.performBuild() wraps the FilterChainProxy in a DebugFilter and logs a prominent multi-line banner warning that security debugging is enabled and may expose sensitive information (request details, security context contents), so it must never run in production. The banner is the only signal; there is no failure.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java:360

		if (this.httpFirewall != null) {
			filterChainProxy.setFirewall(this.httpFirewall);
		}
		if (this.requestRejectedHandler != null) {
			filterChainProxy.setRequestRejectedHandler(this.requestRejectedHandler);
		}
		else if (!this.observationRegistry.isNoop()) {
			CompositeRequestRejectedHandler requestRejectedHandler = new CompositeRequestRejectedHandler(
					new ObservationMarkingRequestRejectedHandler(this.observationRegistry),
					new HttpStatusRequestRejectedHandler());
			filterChainProxy.setRequestRejectedHandler(requestRejectedHandler);
		}
		filterChainProxy.setFilterChainValidator(new WebSecurityFilterChainValidator());
		filterChainProxy.setFilterChainDecorator(getFilterChainDecorator());
		filterChainProxy.afterPropertiesSet();

		Filter result = filterChainProxy;
		if (this.debugEnabled) {
			this.logger.warn("\n\n" + "********************************************************************\n"
					+ "**********        Security debugging is enabled.       *************\n"
					+ "**********    This may include sensitive information.  *************\n"
					+ "**********      Do not use in a production system!     *************\n"
					+ "********************************************************************\n\n");
			result = new DebugFilter(filterChainProxy);
		}

		this.postBuildAction.run();
		return result;
	}

	private boolean addAuthorizationManager(SecurityFilterChain securityFilterChain,
			RequestMatcherDelegatingAuthorizationManager.Builder builder) {
		boolean mappings = false;
		for (Filter filter : securityFilterChain.getFilters()) {
			if (USING_ACCESS) {
				mappings = AccessComponents.addAuthorizationManager(filter, this.servletContext, builder,
						securityFilterChain);

View on GitHub (pinned to 96852e8860)

Solutions

1. Set @EnableWebSecurity(debug = false) (or remove the debug attribute, which defaults to false) in production profiles.
2. Externalize the debug flag so it is only true in local/dev profiles (e.g. via @Profile or a property).
3. Use FilterChainProxy logging or spring-security events instead of the debug filter when diagnosing production issues.

Example fix

// before
@EnableWebSecurity(debug = true)
public class SecurityConfig { }

// after
@EnableWebSecurity(debug = false)
public class SecurityConfig { }

// Fail startup in production if debug is enabled
if (env.acceptsProfiles(Profiles.of("prod")) && debugEnabled) {
    throw new IllegalStateException("Spring Security debug must not be enabled in production");
}

When it happens

Trigger: Calling @EnableWebSecurity(debug = true) or SecurityConfig with debug flag enabled, then booting the app — performBuild() detects this.debugEnabled and logs the banner before installing DebugFilter.

Common situations: Leaving debug=true enabled after local troubleshooting; copying a dev SecurityConfiguration class into production; enabling debug to diagnose filter-chain ordering issues and forgetting to disable it before deploy.

Related errors

• **********************************************************
• Access is denied
• RunAsImplAuthenticationProvider.incorrectKey
• Access is denied
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/8cdadc28eb301a93. Report an issue: GitHub.