spring-projects/spring-security · warning

One of the patterns in %s is missing a leading slash. This i

Error message

One of the patterns in %s is missing a leading slash. This is discouraged; please include the leading slash in all your request matcher patterns. In future versions of Spring Security, leaving out the leading slash will result in an exception.

What it means

AbstractRequestMatcherRegistry.requestMatchers(HttpMethod, String...) warns when one or more supplied URL patterns do not start with '/'. Spring Security historically tolerated this, but patterns without a leading slash are ambiguous with MVC handler matching and will throw an exception in a future release, so the registry nudges developers to fix patterns now.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java:141

	/**
	 * <p>
	 * Match when the {@link HttpMethod} is {@code method} and when the request URI
	 * matches one of {@code patterns}. See
	 * {@link org.springframework.web.util.pattern.PathPattern} for matching rules.
	 * </p>
	 * <p>
	 * If a specific {@link RequestMatcher} must be specified, use
	 * {@link #requestMatchers(RequestMatcher...)} instead
	 * </p>
	 * @param method the {@link HttpMethod} to use or {@code null} for any
	 * {@link HttpMethod}.
	 * @param patterns the patterns to match on
	 * @return the object that is chained after creating the {@link RequestMatcher}.
	 * @since 5.8
	 */
	public C requestMatchers(HttpMethod method, String... patterns) {
		if (anyPathsDontStartWithLeadingSlash(patterns)) {
			this.logger.warn("One of the patterns in " + Arrays.toString(patterns)
					+ " is missing a leading slash. This is discouraged; please include the "
					+ "leading slash in all your request matcher patterns. In future versions of "
					+ "Spring Security, leaving out the leading slash will result in an exception.");
		}
		Assert.state(!this.anyRequestConfigured, "Can't configure requestMatchers after anyRequest");
		PathPatternRequestMatcher.Builder builder = getRequestMatcherBuilder();
		List<RequestMatcher> matchers = new ArrayList<>();
		for (String pattern : patterns) {
			matchers.add(builder.matcher(method, pattern));
		}
		return requestMatchers(matchers.toArray(new RequestMatcher[0]));
	}

	private PathPatternRequestMatcher.Builder getRequestMatcherBuilder() {
		if (this.requestMatcherBuilder != null) {
			return this.requestMatcherBuilder;
		}
		this.requestMatcherBuilder = this.context.getBeanProvider(PathPatternRequestMatcher.Builder.class)

View on GitHub (pinned to 96852e8860)

Solutions

1. Prefix every pattern with '/' in the requestMatchers(...) call.
2. Run the app once in dev; the warning names the offending patterns array — fix each listed one before upgrading Spring Security.
3. If patterns come from configuration/properties, validate at load time that each starts with '/'.

Example fix

// before
http.authorizeHttpRequests(a -> a.requestMatchers(HttpMethod.POST, "api/users").permitAll());

// after
http.authorizeHttpRequests(a -> a.requestMatchers(HttpMethod.POST, "/api/users").permitAll());

for (String p : patterns) {
    if (!p.startsWith("/")) {
        throw new IllegalArgumentException("Pattern must start with '/': " + p);
    }
}
http.authorizeHttpRequests(a -> a.requestMatchers(HttpMethod.GET, patterns));

When it happens

Trigger: Calling http.authorizeHttpRequests(a -> a.requestMatchers(HttpMethod.GET, "login").permitAll()) (or any configurer that routes through requestMatchers) with a pattern lacking the leading '/', while anyRequest has not yet been configured.

Common situations: Copying patterns from controllers ('/login' annotated paths) without the slash; older XML-style antPatterns like 'admin/**' migrated to requestMatchers; typos where the slash was dropped during refactoring to Spring Security 5.8+/6.

Related errors

• Usage of authorizeRequests and FilterSecurityInterceptor are
• authorizationManagerFactory must be an instance of DefaultAu
• Encoded password does not look like SCrypt: {encodedPassword
• It is not recommended to use authorizeRequests or FilterSecu
• It is not recommended to use authorizeRequests or FilterSecu

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/c7bc5ce9b792fc27. Report an issue: GitHub.