spring-projects/spring-security · warning

Security authorization failed due to: %s; authenticated prin

Error message

Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s

What it means

LoggerListener logs a WARN when it receives an AuthorizationFailureEvent, meaning an authenticated principal attempted to access a secure object and the access decision was denied (AccessDeniedException). The message carries the denial exception, the authenticated principal, the secure object, and the required configuration attributes.

Source

Thrown at access/src/main/java/org/springframework/security/access/event/LoggerListener.java:75

	private void onAuthenticationCredentialsNotFoundEvent(AuthenticationCredentialsNotFoundEvent authEvent) {
		logger.warn(LogMessage.format(
				"Security interception failed due to: %s; secure object: %s; configuration attributes: %s",
				authEvent.getCredentialsNotFoundException(), authEvent.getSource(), authEvent.getConfigAttributes()));
	}

	private void onPublicInvocationEvent(PublicInvocationEvent event) {
		logger.info(LogMessage.format("Security interception not required for public secure object: %s",
				event.getSource()));
	}

	private void onAuthorizedEvent(AuthorizedEvent authEvent) {
		logger.info(LogMessage.format(
				"Security authorized for authenticated principal: %s; secure object: %s; configuration attributes: %s",
				authEvent.getAuthentication(), authEvent.getSource(), authEvent.getConfigAttributes()));
	}

	private void onAuthorizationFailureEvent(AuthorizationFailureEvent authEvent) {
		logger.warn(LogMessage.format(
				"Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s",
				authEvent.getAccessDeniedException(), authEvent.getAuthentication(), authEvent.getSource(),
				authEvent.getConfigAttributes()));
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Inspect the logged principal's authorities and the required config attributes; grant the missing authority or relax the rule.
2. Check role naming: hasRole('ADMIN') requires authority ROLE_ADMIN; use hasAuthority for exact matching.
3. Verify the JWT/converter maps the expected claims into GrantedAuthorities.
4. If denials are expected (attack traffic), keep as WARN or scope LoggerListener to specific packages.

Example fix

// before: rule demands role user lacks
http.authorizeHttpRequests(a -> a.requestMatchers("/admin/**").hasRole("ADMIN"));
// after: map authority correctly or permit the intended role
http.authorizeHttpRequests(a -> a.requestMatchers("/admin/**")
        .hasAuthority("ROLE_ADMIN"));

// verify the principal's authorities include the required attribute
Collection<? extends GrantedAuthority> auths =
    SecurityContextHolder.getContext().getAuthentication().getAuthorities();
boolean ok = auths.stream().anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"));
if (!ok) throw new AccessDeniedException("Missing ROLE_ADMIN");

try {
    chain.doFilter(req, res);
} catch (AccessDeniedException e) {
    // authenticated but insufficient rights: forward to /403, not login
    request.getRequestDispatcher("/403").forward(req, res);
}

When it happens

Trigger: Any denied access decision publishing AuthorizationFailureEvent: an authenticated user lacking required roles/authorities on a URL (authorizeHttpRequests) or method (@PreAuthorize/@PostAuthorize), with LoggerListener registered to log it.

Common situations: Users without the expected role hitting admin endpoints; method-security SpEL referencing wrong role names (missing ROLE_ prefix); CSRF-denied POSTs surfacing as authorization failures; authority mapping errors in UserDetailsService/JWT converters.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Security interception failed due to: %s; secure object: %s;
• Access is denied
• Access is denied
• Access is denied
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/8cfdd7d36e84ea61. Report an issue: GitHub.