spring-projects/spring-security · warning

It is not recommended to use authorizeRequests or FilterSecu

Error message

It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests

What it means

DefaultFilterChainValidator (the validator used by the XML <http> / namespace configuration) checks each filter chain for a mix of AuthorizationFilter and FilterSecurityInterceptor. When both are found in one chain, it warns that running authorizeRequests (FilterSecurityInterceptor) alongside authorizeHttpRequests (AuthorizationFilter) is not recommended and that authorizeHttpRequests should be the only authorization mechanism.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java:132

				filterChain = defaultChain;
			}
		}
	}

	private void checkAuthorizationFilters(List<SecurityFilterChain> chains) {
		Filter authorizationFilter = null;
		Filter filterSecurityInterceptor = null;
		for (SecurityFilterChain chain : chains) {
			for (Filter filter : chain.getFilters()) {
				if (filter instanceof AuthorizationFilter) {
					authorizationFilter = filter;
				}
				if (USING_ACCESS && AccessComponents.isFilterSecurityInterceptor(filter)) {
					filterSecurityInterceptor = filter;
				}
			}
			if (authorizationFilter != null && filterSecurityInterceptor != null) {
				this.logger.warn(
						"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests");
			}
			if (filterSecurityInterceptor != null) {
				this.logger.warn(
						"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration");
			}
			authorizationFilter = null;
			filterSecurityInterceptor = null;
		}
	}

	@SuppressWarnings({ "unchecked" })
	private static <F extends Filter> F getFilter(Class<F> type, List<Filter> filters) {
		for (Filter f : filters) {
			if (type.isAssignableFrom(f.getClass())) {
				return (F) f;
			}
		}

View on GitHub (pinned to 96852e8860)

Solutions

Convert the legacy <intercept-url>/authorizeRequests rules to authorizeHttpRequests and remove FilterSecurityInterceptor from the chain.
If stuck on XML security, keep a single authorization mechanism per chain and migrate chain-by-chain.
Ensure no custom bean definitions inject a FilterSecurityInterceptor into chains that already use AuthorizationFilter.

Example fix

// before
http.authorizeRequests(a -> a.antMatchers("/api/**").authenticated());
http.addFilter(new AuthorizationFilter(manager));

// after
http.authorizeHttpRequests(a -> a.requestMatchers("/api/**").authenticated());

Defensive patterns

Strategy: validation

Validate before calling

// Namespace-config guard: ensure single authorization mechanism
boolean mixed = filters.stream().anyMatch(f -> f instanceof FilterSecurityInterceptor)
    && filters.stream().anyMatch(f -> f instanceof AuthorizationFilter);
if (mixed) {
    throw new IllegalStateException("XML http config mixes FilterSecurityInterceptor with AuthorizationFilter");
}

Prevention

Migrate <http> intercept-url rules to authorizeHttpRequests before adding any new rules.
Avoid hand-adding AuthorizationFilter to XML-defined chains mid-migration.
Run DefaultFilterChainValidator output through CI log checks to catch mixed chains early.

When it happens

Trigger: An XML/namespace-configured security setup (validated via DefaultFilterChainValidator.validate() -> checkAuthorizationFilters) whose chain contains both an AuthorizationFilter and a FilterSecurityInterceptor, e.g. <http> with legacy intercept-url plus manually added AuthorizationFilter.

Common situations: Hybrid XML + Java config migrations; adding authorizeHttpRequests-style filters to legacy <http> definitions; upgrading applications gradually while both authorization systems remain registered.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/394ef801d0f09036. Report an issue: GitHub.