spring-projects/spring-security · warning

Security interception failed due to: %s; secure object: %s;

Error message

Security interception failed due to: %s; secure object: %s; configuration attributes: %s

What it means

LoggerListener (an ApplicationListener) logs a WARN when it receives an AuthenticationCredentialsNotFoundEvent, meaning security interception was attempted on a secure object but no Authentication existed in the SecurityContextHolder at all (as opposed to a failed authentication). The message includes the exception, the secure object, and the required configuration attributes.

Source

Thrown at access/src/main/java/org/springframework/security/access/event/LoggerListener.java:58

	@Override
	public void onApplicationEvent(AbstractAuthorizationEvent event) {
		if (event instanceof AuthenticationCredentialsNotFoundEvent) {
			onAuthenticationCredentialsNotFoundEvent((AuthenticationCredentialsNotFoundEvent) event);
		}
		if (event instanceof AuthorizationFailureEvent) {
			onAuthorizationFailureEvent((AuthorizationFailureEvent) event);
		}
		if (event instanceof AuthorizedEvent) {
			onAuthorizedEvent((AuthorizedEvent) event);
		}
		if (event instanceof PublicInvocationEvent) {
			onPublicInvocationEvent((PublicInvocationEvent) event);
		}
	}

	private void onAuthenticationCredentialsNotFoundEvent(AuthenticationCredentialsNotFoundEvent authEvent) {
		logger.warn(LogMessage.format(
				"Security interception failed due to: %s; secure object: %s; configuration attributes: %s",
				authEvent.getCredentialsNotFoundException(), authEvent.getSource(), authEvent.getConfigAttributes()));
	}

	private void onPublicInvocationEvent(PublicInvocationEvent event) {
		logger.info(LogMessage.format("Security interception not required for public secure object: %s",
				event.getSource()));
	}

	private void onAuthorizedEvent(AuthorizedEvent authEvent) {
		logger.info(LogMessage.format(
				"Security authorized for authenticated principal: %s; secure object: %s; configuration attributes: %s",
				authEvent.getAuthentication(), authEvent.getSource(), authEvent.getConfigAttributes()));
	}

	private void onAuthorizationFailureEvent(AuthorizationFailureEvent authEvent) {
		logger.warn(LogMessage.format(
				"Security authorization failed due to: %s; authenticated principal: %s; secure object: %s; configuration attributes: %s",

View on GitHub (pinned to 96852e8860)

Solutions

1. Ensure the SecurityContext is populated before the secured invocation (authentication filter, or explicitly set SecurityContextHolder).
2. For async/scheduled code, use DelegatingSecurityContextExecutor/Async or set a system authentication.
3. Remove or re-scope LoggerListener if the WARN noise is not wanted.
4. Verify method-security interception points are behind authentication machinery (e.g. correct proxy order).

Example fix

// before: async task loses security context
executor.execute(() -> securedService.doWork());
// after: propagate context
delegatingExecutor.execute(() -> securedService.doWork());
// new DelegatingSecurityContextExecutor(delegate)

// ensure authentication exists before invoking secured methods
if (SecurityContextHolder.getContext().getAuthentication() == null) {
    throw new IllegalStateException("No authentication in context");
}

try {
    securedService.doWork();
} catch (AuthenticationCredentialsNotFoundException e) {
    // set a system authentication or redirect user to login
    SecurityContextHolder.getContext().setAuthentication(systemAuth);
}

When it happens

Trigger: An AuthorizationInterceptor/Aspect on a method or a security interceptor invoked with no SecurityContext authentication present, publishing AuthenticationCredentialsNotFoundEvent; enabling LoggerListener as a bean makes this event log at WARN.

Common situations: Calling a @PreAuthorize/@Secured-annotated method from a non-web or async context where the SecurityContext was not propagated; interceptor wired before any authentication filter ran; scheduled tasks lacking a runAs/system authentication.

Related errors

• Security authorization failed due to: %s; authenticated prin
• Expression was null but expected boolean result '{expression
• Failed to evaluate expression '{expressionString}'
• Access is denied
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/821d4a5306475f83. Report an issue: GitHub.