spring-projects/spring-security · error · IllegalStateException

Invalid configuration that explicitly sets requireExplicitAu

Error message

Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy to {} but implicitly requires it due to the following properties being set: {}

What it means

SessionManagementConfigurer checks whether explicit requireExplicitAuthenticationStrategy(true) conflicts with implicit requirements. If properties such as session fixation protection, session concurrency, or session-authentication settings implicitly require an explicit authentication strategy (default would be true), but the developer explicitly set requireExplicitAuthenticationStrategy(false), shouldRequireExplicitAuthenticationStrategy() throws IllegalStateException listing the offending properties.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java:426

		}
		if (!this.enableSessionUrlRewriting) {
			http.addFilter(new DisableEncodeUrlFilter());
		}
		if (this.sessionPolicy == SessionCreationPolicy.ALWAYS) {
			http.addFilter(new ForceEagerSessionCreationFilter());
		}
	}

	private boolean shouldRequireExplicitAuthenticationStrategy() {
		boolean defaultRequireExplicitAuthenticationStrategy = this.propertiesThatRequireImplicitAuthentication
			.isEmpty();
		if (this.requireExplicitAuthenticationStrategy == null) {
			// explicit is not set, use default
			return defaultRequireExplicitAuthenticationStrategy;
		}
		if (this.requireExplicitAuthenticationStrategy && !defaultRequireExplicitAuthenticationStrategy) {
			// explicit disabled and implicit requires it
			throw new IllegalStateException(
					"Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy to "
							+ this.requireExplicitAuthenticationStrategy
							+ " but implicitly requires it due to the following properties being set: "
							+ this.propertiesThatRequireImplicitAuthentication);
		}
		return this.requireExplicitAuthenticationStrategy;
	}

	private SessionManagementFilter createSessionManagementFilter(H http) {
		if (shouldRequireExplicitAuthenticationStrategy()) {
			return null;
		}
		SecurityContextRepository securityContextRepository = this.sessionManagementSecurityContextRepository;
		SessionManagementFilter sessionManagementFilter = new SessionManagementFilter(securityContextRepository,
				getSessionAuthenticationStrategy(http));
		if (this.sessionAuthenticationErrorUrl != null) {
			sessionManagementFilter.setAuthenticationFailureHandler(
					new SimpleUrlAuthenticationFailureHandler(this.sessionAuthenticationErrorUrl));

View on GitHub (pinned to 96852e8860)

Solutions

1. Remove requireExplicitAuthenticationStrategy(false) so the implicit requirement (true) applies
2. Remove the session-management features that require implicit explicit-authentication strategy (e.g. maximumSessions, sessionAuthenticationErrorUrl, session-fixation customization) if the flag false is truly desired
3. Read the exception message — it lists exactly which properties caused the conflict — and reconcile those with the flag

Example fix

// before
http.sessionManagement(s -> s.requireExplicitAuthenticationStrategy(false).maximumSessions(1));
// after
http.sessionManagement(s -> s.maximumSessions(1)); // drop the explicit false
// or drop maximumSessions if explicit false is required

// before setting the flag
boolean implicitRequired = usesMaximumSessions || hasSessionAuthenticationErrorUrl
        || usesSessionFixationProtection || hasCustomSessionAuthenticationStrategy;
if (implicitRequired && explicitFalseSet) {
    throw new IllegalStateException("requireExplicitAuthenticationStrategy(false) conflicts with session-management settings that require it");
}

try {
    http.sessionManagement(s -> s.maximumSessions(1));
} catch (IllegalStateException e) {
    if (e.getMessage().startsWith("Invalid configuration that explicitly sets requireExplicitAuthenticationStrategy")) {
        // reconcile: drop the explicit false or the conflicting properties named in the message
    }
}

When it happens

Trigger: Calling sessionManagement(s -> s.requireExplicitAuthenticationStrategy(false)) while other settings on the same configurer (tracked in propertiesThatRequireImplicitAuthentication, e.g. sessionAuthenticationErrorUrl, maximumSessions, sessionAuthenticationStrategy customizations) implicitly require it true.

Common situations: Disabling explicit-strategy requirement to silence warnings while keeping concurrency-control or session-fixation settings active; merging configurations where one part sets the flag false and another enables session management features.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Cannot apply {configurer} to already built object
• Cannot configure both a CorsConfigurationSource and a PreFli
• Headers security is enabled, but no headers will be added. E
• This object has already been built
• This object has not been built

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/31457a8e19669223. Report an issue: GitHub.