spring-projects/spring-security · warning

**********************************************************

Error message

********************************************************************
**********        Security debugging is enabled.       *************
**********    This may include sensitive information.  *************
**********      Do not use in a production system!     *************
********************************************************************

What it means

SecurityDebugBeanFactoryPostProcessor is registered when @EnableWebSecurity(debug = true) is used with the XML/bean-based setup. Its postProcessBeanDefinitionRegistry logs the same multi-line banner as WebSecurity, warning that security debugging is enabled, may leak sensitive information, and must not be used in production, before it swaps in debug-related bean definitions (e.g. wiring DebugFilter via FILTER_CHAIN_PROXY).

Source

Thrown at config/src/main/java/org/springframework/security/config/debug/SecurityDebugBeanFactoryPostProcessor.java:44

import org.springframework.beans.factory.support.BeanDefinitionRegistry;
import org.springframework.beans.factory.support.BeanDefinitionRegistryPostProcessor;
import org.springframework.security.config.BeanIds;
import org.springframework.security.web.debug.DebugFilter;

/**
 * Wraps the {@code FilterChainProxy} bean definition with a {@link DebugFilter} to enable
 * security debugging.
 *
 * @author Luke Taylor
 * @author Rob Winch
 */
public class SecurityDebugBeanFactoryPostProcessor implements BeanDefinitionRegistryPostProcessor {

	private final Log logger = LogFactory.getLog(getClass());

	@Override
	public void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {
		this.logger.warn("\n\n" + "********************************************************************\n"
				+ "**********        Security debugging is enabled.       *************\n"
				+ "**********    This may include sensitive information.  *************\n"
				+ "**********      Do not use in a production system!     *************\n"
				+ "********************************************************************\n\n");
		// SPRING_SECURITY_FILTER_CHAIN does not exist yet since it is an alias that has
		// not been processed, so use FILTER_CHAIN_PROXY
		if (registry.containsBeanDefinition(BeanIds.FILTER_CHAIN_PROXY)) {
			BeanDefinition fcpBeanDef = registry.getBeanDefinition(BeanIds.FILTER_CHAIN_PROXY);
			BeanDefinitionBuilder debugFilterBldr = BeanDefinitionBuilder.genericBeanDefinition(DebugFilter.class);
			debugFilterBldr.addConstructorArgValue(fcpBeanDef);
			// Remove the alias to SPRING_SECURITY_FILTER_CHAIN, so that it does not
			// override the new
			// SPRING_SECURITY_FILTER_CHAIN definition
			registry.removeAlias(BeanIds.SPRING_SECURITY_FILTER_CHAIN);
			registry.registerBeanDefinition(BeanIds.SPRING_SECURITY_FILTER_CHAIN, debugFilterBldr.getBeanDefinition());
		}
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Remove debug = true (or set debug = false) from @EnableWebSecurity in production code paths.
2. Gate the debug config behind a dev-only profile or property so production contexts never register the post-processor.
3. Check built artifacts/config scanning to ensure no test or sample configuration with debug=true is component-scanned in production.

Example fix

// before
@EnableWebSecurity(debug = true)
@Configuration
public class DebugSecurityConfig { }

// after
@Configuration
@Profile({"dev", "local"})
@EnableWebSecurity(debug = true)
public class DebugSecurityConfig { }

// Production context guard
if (env.getActiveProfiles().length > 0 && Set.of(env.getActiveProfiles()).contains("prod") && debugEnabled) {
    throw new IllegalStateException("SecurityDebugBeanFactoryPostProcessor registered in production profile");
}

When it happens

Trigger: Booting an application context where @EnableWebSecurity(debug = true) imported SecurityDebugBeanFactoryPostProcessor; the banner is logged once during bean-definition-registry post-processing at context startup.

Common situations: Debug flag left on after troubleshooting; XML-based security configs copied from dev environments; enabling debug to inspect the published filter chain and forgetting to turn it off before release builds.

Related errors

• **********************************************************
• Access is denied
• RunAsImplAuthenticationProvider.incorrectKey
• Access is denied
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/aab71127e6a91be2. Report an issue: GitHub.