spring-projects/spring-security · error · BadCredentialsException

No pre-authenticated credentials found in request.

Error message

No pre-authenticated credentials found in request.

What it means

PreAuthenticatedAuthenticationProvider.authenticate() rejects any PreAuthenticatedAuthenticationToken whose credentials are null. Pre-auth tokens carry the pre-authenticated 'credential' evidence (e.g. a certificate or the raw header); without it the provider treats the token as invalid and throws BadCredentialsException if throwExceptionWhenTokenRejected is true, otherwise returns null so another provider can be tried.

Source

Thrown at web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedAuthenticationProvider.java:102

	 * be ignored to allow other providers to authenticate it.
	 */
	@Override
	public @Nullable Authentication authenticate(Authentication authentication) throws AuthenticationException {
		if (!supports(authentication.getClass())) {
			return null;
		}
		logger.debug(LogMessage.format("PreAuthenticated authentication request: %s", authentication));
		if (authentication.getPrincipal() == null) {
			logger.debug("No pre-authenticated principal found in request.");
			if (this.throwExceptionWhenTokenRejected) {
				throw new BadCredentialsException("No pre-authenticated principal found in request.");
			}
			return null;
		}
		if (authentication.getCredentials() == null) {
			logger.debug("No pre-authenticated credentials found in request.");
			if (this.throwExceptionWhenTokenRejected) {
				throw new BadCredentialsException("No pre-authenticated credentials found in request.");
			}
			return null;
		}
		UserDetails userDetails = this.preAuthenticatedUserDetailsService
			.loadUserDetails((PreAuthenticatedAuthenticationToken) authentication);
		this.userDetailsChecker.check(userDetails);
		Collection<GrantedAuthority> authorities = new LinkedHashSet<>(userDetails.getAuthorities());
		authorities.addAll(this.grantedAuthoritySupplier.get());
		PreAuthenticatedAuthenticationToken result = new PreAuthenticatedAuthenticationToken(userDetails,
				authentication.getCredentials(), authorities);
		result.setDetails(authentication.getDetails());
		return result;
	}

	/**
	 * Indicate that this provider only supports PreAuthenticatedAuthenticationToken
	 * (sub)classes.
	 */

View on GitHub (pinned to 96852e8860)

Solutions

1. Make your pre-auth filter's getPreAuthenticatedCredentials() return non-null (commonly the request header value or the HttpServletRequest itself).
2. Set throwExceptionWhenTokenRejected=false to skip this provider rather than throw when credentials are missing.
3. If using X.509/client-cert auth, verify the client actually sends the certificate and TLS client-auth is configured on the connector.
4. In tests, build the token with both arguments: new PreAuthenticatedAuthenticationToken("user", "creds").

Example fix

// before
@Override
protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
    return null; // triggers BadCredentialsException
}
// after
@Override
protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
    return request.getHeader("X-PreAuth-Token");
}

if (token.getCredentials() == null) {
    throw new IllegalStateException("Pre-auth token has no credentials; fix getPreAuthenticatedCredentials()");
}
provider.authenticate(token);

boolean hasCredentials = (auth != null && auth.getCredentials() != null);

When it happens

Trigger: Calling authenticate() with a PreAuthenticatedAuthenticationToken built as new PreAuthenticatedAuthenticationToken(principal, null), or an upstream filter that populated the principal but left credentials empty, while throwExceptionWhenTokenRejected=true.

Common situations: Custom AbstractPreAuthenticatedProcessingFilter subclass that returns the SSO user but null for getPreAuthenticatedCredentials; client-cert (X.509) setups where the certificate was not presented by the client; test code constructing tokens with only a principal.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No pre-authenticated principal found in request.
• RunAsImplAuthenticationProvider.incorrectKey
• CasAuthenticationProvider.incorrectKey
• Bad credentials
• Failed to authenticate the one-time token

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/1ecce736014888ad. Report an issue: GitHub.