spring-projects/spring-security · warning

Security authorization failed due to

Error message

Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s

What it means

LoggerListener logs a WARN when it receives an AuthorizationFailureEvent, meaning an authenticated principal attempted to access a secure object and the access decision was denied (AccessDeniedException). The message carries the denial exception, the authenticated principal, the secure object, and the required configuration attributes.

Solutions

1. Inspect the logged principal's authorities and the required config attributes; grant the missing authority or relax the rule.
2. Check role naming: hasRole('ADMIN') requires authority ROLE_ADMIN; use hasAuthority for exact matching.
3. Verify the JWT/converter maps the expected claims into GrantedAuthorities.
4. If denials are expected (attack traffic), keep as WARN or scope LoggerListener to specific packages.

Example fix

// before: rule demands role user lacks
http.authorizeHttpRequests(a -> a.requestMatchers("/admin/**").hasRole("ADMIN"));
// after: map authority correctly or permit the intended role
http.authorizeHttpRequests(a -> a.requestMatchers("/admin/**")
        .hasAuthority("ROLE_ADMIN"));

// verify the principal's authorities include the required attribute
Collection<? extends GrantedAuthority> auths =
    SecurityContextHolder.getContext().getAuthentication().getAuthorities();
boolean ok = auths.stream().anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"));
if (!ok) throw new AccessDeniedException("Missing ROLE_ADMIN");

try {
    chain.doFilter(req, res);
} catch (AccessDeniedException e) {
    // authenticated but insufficient rights: forward to /403, not login
    request.getRequestDispatcher("/403").forward(req, res);
}

When it happens

Trigger: Any denied access decision publishing AuthorizationFailureEvent: an authenticated user lacking required roles/authorities on a URL (authorizeHttpRequests) or method (@PreAuthorize/@PostAuthorize), with LoggerListener registered to log it.

Common situations: Users without the expected role hitting admin endpoints; method-security SpEL referencing wrong role names (missing ROLE_ prefix); CSRF-denied POSTs surfacing as authorization failures; authority mapping errors in UserDetailsService/JWT converters.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Security interception failed due to
• Access Denied
• Access is denied
• Access is denied
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/8cfdd7d36e84ea61. Report an issue: GitHub.

Appendix: source

Thrown at access/src/main/java/org/springframework/security/access/event/LoggerListener.java:75

	private void onAuthenticationCredentialsNotFoundEvent(AuthenticationCredentialsNotFoundEvent authEvent) {
		logger.warn(LogMessage.format(
				"Security interception failed due to: %s; secure object: %s; configuration attributes: %s",
				authEvent.getCredentialsNotFoundException(), authEvent.getSource(), authEvent.getConfigAttributes()));
	}

	private void onPublicInvocationEvent(PublicInvocationEvent event) {
		logger.info(LogMessage.format("Security interception not required for public secure object: %s",
				event.getSource()));
	}

	private void onAuthorizedEvent(AuthorizedEvent authEvent) {
		logger.info(LogMessage.format(
				"Security authorized for authenticated principal: %s; secure object: %s; configuration attributes: %s",
				authEvent.getAuthentication(), authEvent.getSource(), authEvent.getConfigAttributes()));
	}

	private void onAuthorizationFailureEvent(AuthorizationFailureEvent authEvent) {
		logger.warn(LogMessage.format(
				"Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s",
				authEvent.getAccessDeniedException(), authEvent.getAuthentication(), authEvent.getSource(),
				authEvent.getConfigAttributes()));
	}

}

View on GitHub (pinned to 96852e8860)