spring-projects/spring-security · warning

It is not recommended to use authorizeRequests or FilterSecu

Error message

It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests

What it means

WebSecurityFilterChainValidator.checkAuthorizationFilters() inspects each SecurityFilterChain for both AuthorizationFilter (the authorizeHttpRequests mechanism) and FilterSecurityInterceptor (the deprecated authorizeRequests mechanism). If both appear in the same chain, two authorization systems coexist with different semantics, and a warning is logged recommending authorizeHttpRequests only.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurityFilterChainValidator.java:105

				filterChain = defaultChain;
			}
		}
	}

	private void checkAuthorizationFilters(List<SecurityFilterChain> chains) {
		Filter authorizationFilter = null;
		Filter filterSecurityInterceptor = null;
		for (SecurityFilterChain chain : chains) {
			for (Filter filter : chain.getFilters()) {
				if (filter instanceof AuthorizationFilter) {
					authorizationFilter = filter;
				}
				if (USING_ACCESS && AccessComponents.isFilterSecurityInterceptor(filter)) {
					filterSecurityInterceptor = filter;
				}
			}
			if (authorizationFilter != null && filterSecurityInterceptor != null) {
				this.logger.warn(
						"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests");
			}
			if (filterSecurityInterceptor != null) {
				this.logger.warn(
						"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration");
			}
			authorizationFilter = null;
			filterSecurityInterceptor = null;
		}
	}

	private static final class AccessComponents {

		private static boolean isFilterSecurityInterceptor(Filter filter) {
			return filter instanceof FilterSecurityInterceptor;
		}

	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Remove authorizeRequests()/FilterSecurityInterceptor and express all rules with authorizeHttpRequests().
2. If FilterSecurityInterceptor is still needed for method-security-like checks, remove the AuthorizationFilter from that chain so only one mechanism applies.
3. Audit all SecurityFilterChain beans (including custom ones) so each chain uses a single authorization model.

Example fix

// before
http.authorizeRequests(a -> a.antMatchers("/admin/**").hasRole("ADMIN"))
    .authorizeHttpRequests(a -> a.anyRequest().authenticated());

// after
http.authorizeHttpRequests(a -> a.requestMatchers("/admin/**").hasRole("ADMIN").anyRequest().authenticated());

// Startup guard: only one authorization mechanism per chain
boolean hasInterceptor = chain.getFilters().stream()
    .anyMatch(f -> f instanceof FilterSecurityInterceptor);
boolean hasAuthorizationFilter = chain.getFilters().stream()
    .anyMatch(f -> f instanceof AuthorizationFilter);
if (hasInterceptor && hasAuthorizationFilter) {
    throw new IllegalStateException("Chain mixes FilterSecurityInterceptor and AuthorizationFilter");
}

When it happens

Trigger: A SecurityFilterChain containing both an AuthorizationFilter and a FilterSecurityInterceptor — e.g. an HttpSecurity config that configures both authorizeRequests() and authorizeHttpRequests(), or custom code that inserts a FilterSecurityInterceptor into a modern chain. validate() calls checkAuthorizationFilters at startup.

Common situations: Partially migrated configs where legacy authorizeRequests() rules were kept alongside new authorizeHttpRequests() rules; custom filters copied from old projects; XML http element coexisting with newer Java config adding AuthorizationFilter.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

• Usage of authorizeRequests and FilterSecurityInterceptor are
• Anonymous access to the login page doesn't appear to be enab
• You are asking Spring Security to ignore %s. This is not rec
• Usage of authorizeRequests and FilterSecurityInterceptor are
• It is not recommended to use authorizeRequests or FilterSecu

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/02d962f05c561b84. Report an issue: GitHub.