spring-projects/spring-security · error · IllegalStateException

Invalid configuration that explicitly sets…

Error message

Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy to {} but implicitly requires it due to the following properties being set: {}

What it means

SessionManagementConfigurer checks whether explicit requireExplicitAuthenticationStrategy(true) conflicts with implicit requirements. If properties such as session fixation protection, session concurrency, or session-authentication settings implicitly require an explicit authentication strategy (default would be true), but the developer explicitly set requireExplicitAuthenticationStrategy(false), shouldRequireExplicitAuthenticationStrategy() throws IllegalStateException listing the offending properties.

Solutions

1. Remove requireExplicitAuthenticationStrategy(false) so the implicit requirement (true) applies
2. Remove the session-management features that require implicit explicit-authentication strategy (e.g. maximumSessions, sessionAuthenticationErrorUrl, session-fixation customization) if the flag false is truly desired
3. Read the exception message — it lists exactly which properties caused the conflict — and reconcile those with the flag

Example fix

// before
http.sessionManagement(s -> s.requireExplicitAuthenticationStrategy(false).maximumSessions(1));
// after
http.sessionManagement(s -> s.maximumSessions(1)); // drop the explicit false
// or drop maximumSessions if explicit false is required

// before setting the flag
boolean implicitRequired = usesMaximumSessions || hasSessionAuthenticationErrorUrl
        || usesSessionFixationProtection || hasCustomSessionAuthenticationStrategy;
if (implicitRequired && explicitFalseSet) {
    throw new IllegalStateException("requireExplicitAuthenticationStrategy(false) conflicts with session-management settings that require it");
}

try {
    http.sessionManagement(s -> s.maximumSessions(1));
} catch (IllegalStateException e) {
    if (e.getMessage().startsWith("Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy")) {
        // reconcile: drop the explicit false or the conflicting properties named in the message
    }
}

When it happens

Trigger: Calling sessionManagement(s -> s.requireExplicitAuthenticationStrategy(false)) while other settings on the same configurer (tracked in propertiesThatRequireImplicitAuthentication, e.g. sessionAuthenticationErrorUrl, maximumSessions, sessionAuthenticationStrategy customizations) implicitly require it true.

Common situations: Disabling explicit-strategy requirement to silence warnings while keeping concurrency-control or session-fixation settings active; merging configurations where one part sets the flag false and another enables session management features.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Cannot apply to already built object
• Cannot configure both a CorsConfigurationSource and a…
• Headers security is enabled, but no headers will be added…
• A filter chain that matches any request
• authorizationManagerFactory must be an instance of…

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/31457a8e19669223. Report an issue: GitHub.

Appendix: source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java:426

		}
		if (!this.enableSessionUrlRewriting) {
			http.addFilter(new DisableEncodeUrlFilter());
		}
		if (this.sessionPolicy == SessionCreationPolicy.ALWAYS) {
			http.addFilter(new ForceEagerSessionCreationFilter());
		}
	}

	private boolean shouldRequireExplicitAuthenticationStrategy() {
		boolean defaultRequireExplicitAuthenticationStrategy = this.propertiesThatRequireImplicitAuthentication
			.isEmpty();
		if (this.requireExplicitAuthenticationStrategy == null) {
			// explicit is not set, use default
			return defaultRequireExplicitAuthenticationStrategy;
		}
		if (this.requireExplicitAuthenticationStrategy && !defaultRequireExplicitAuthenticationStrategy) {
			// explicit disabled and implicit requires it
			throw new IllegalStateException(
					"Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy to "
							+ this.requireExplicitAuthenticationStrategy
							+ " but implicitly requires it due to the following properties being set: "
							+ this.propertiesThatRequireImplicitAuthentication);
		}
		return this.requireExplicitAuthenticationStrategy;
	}

	private SessionManagementFilter createSessionManagementFilter(H http) {
		if (shouldRequireExplicitAuthenticationStrategy()) {
			return null;
		}
		SecurityContextRepository securityContextRepository = this.sessionManagementSecurityContextRepository;
		SessionManagementFilter sessionManagementFilter = new SessionManagementFilter(securityContextRepository,
				getSessionAuthenticationStrategy(http));
		if (this.sessionAuthenticationErrorUrl != null) {
			sessionManagementFilter.setAuthenticationFailureHandler(
					new SimpleUrlAuthenticationFailureHandler(this.sessionAuthenticationErrorUrl));

View on GitHub (pinned to 96852e8860)