spring-projects/spring-security · warning

Security interception failed due to

Error message

Security interception failed due to: %s; secure object: %s; configuration attributes: %s

What it means

LoggerListener (an ApplicationListener) logs a WARN when it receives an AuthenticationCredentialsNotFoundEvent, meaning security interception was attempted on a secure object but no Authentication existed in the SecurityContextHolder at all (as opposed to a failed authentication). The message includes the exception, the secure object, and the required configuration attributes.

Solutions

1. Ensure the SecurityContext is populated before the secured invocation (authentication filter, or explicitly set SecurityContextHolder).
2. For async/scheduled code, use DelegatingSecurityContextExecutor/Async or set a system authentication.
3. Remove or re-scope LoggerListener if the WARN noise is not wanted.
4. Verify method-security interception points are behind authentication machinery (e.g. correct proxy order).

Example fix

// before: async task loses security context
executor.execute(() -> securedService.doWork());
// after: propagate context
delegatingExecutor.execute(() -> securedService.doWork());
// new DelegatingSecurityContextExecutor(delegate)

// ensure authentication exists before invoking secured methods
if (SecurityContextHolder.getContext().getAuthentication() == null) {
    throw new IllegalStateException("No authentication in context");
}

try {
    securedService.doWork();
} catch (AuthenticationCredentialsNotFoundException e) {
    // set a system authentication or redirect user to login
    SecurityContextHolder.getContext().setAuthentication(systemAuth);
}

When it happens

Trigger: An AuthorizationInterceptor/Aspect on a method or a security interceptor invoked with no SecurityContext authentication present, publishing AuthenticationCredentialsNotFoundEvent; enabling LoggerListener as a bean makes this event log at WARN.

Common situations: Calling a @PreAuthorize/@Secured-annotated method from a non-web or async context where the SecurityContext was not propagated; interceptor wired before any authentication filter ran; scheduled tasks lacking a runAs/system authentication.

Related errors

• Security authorization failed due to
• Expression was null but expected boolean result
• Failed to evaluate expression
• Access Denied
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/821d4a5306475f83. Report an issue: GitHub.

Appendix: source

Thrown at access/src/main/java/org/springframework/security/access/event/LoggerListener.java:58

	@Override
	public void onApplicationEvent(AbstractAuthorizationEvent event) {
		if (event instanceof AuthenticationCredentialsNotFoundEvent) {
			onAuthenticationCredentialsNotFoundEvent((AuthenticationCredentialsNotFoundEvent) event);
		}
		if (event instanceof AuthorizationFailureEvent) {
			onAuthorizationFailureEvent((AuthorizationFailureEvent) event);
		}
		if (event instanceof AuthorizedEvent) {
			onAuthorizedEvent((AuthorizedEvent) event);
		}
		if (event instanceof PublicInvocationEvent) {
			onPublicInvocationEvent((PublicInvocationEvent) event);
		}
	}

	private void onAuthenticationCredentialsNotFoundEvent(AuthenticationCredentialsNotFoundEvent authEvent) {
		logger.warn(LogMessage.format(
				"Security interception failed due to: %s; secure object: %s; configuration attributes: %s",
				authEvent.getCredentialsNotFoundException(), authEvent.getSource(), authEvent.getConfigAttributes()));
	}

	private void onPublicInvocationEvent(PublicInvocationEvent event) {
		logger.info(LogMessage.format("Security interception not required for public secure object: %s",
				event.getSource()));
	}

	private void onAuthorizedEvent(AuthorizedEvent authEvent) {
		logger.info(LogMessage.format(
				"Security authorized for authenticated principal: %s; secure object: %s; configuration attributes: %s",
				authEvent.getAuthentication(), authEvent.getSource(), authEvent.getConfigAttributes()));
	}

	private void onAuthorizationFailureEvent(AuthorizationFailureEvent authEvent) {
		logger.warn(LogMessage.format(
				"Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s",

View on GitHub (pinned to 96852e8860)