spring-projects/spring-security · error · AuthenticationCredentialsNotFoundException

SwitchUserFilter.noCurrentUser

SwitchUserFilter.noCurrentUser

Error message

No current user associated with this request

What it means

SwitchUserFilter.attemptExitUser needs the current Authentication to find the original user stored in a SwitchUserGrantedAuthority. If the SecurityContext holds no Authentication, it throws AuthenticationCredentialsNotFoundException mapped from message code SwitchUserFilter.noCurrentUser. You cannot switch back to a user when there is no current user at all.

Source

Thrown at web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilter.java:267

			}
		}
		return targetUserRequest;
	}

	/**
	 * Attempt to exit from an already switched user.
	 * @param request The http servlet request
	 * @return The original <code>Authentication</code> object or <code>null</code>
	 * otherwise.
	 * @throws AuthenticationCredentialsNotFoundException If no
	 * <code>Authentication</code> associated with this request.
	 */
	protected Authentication attemptExitUser(HttpServletRequest request)
			throws AuthenticationCredentialsNotFoundException {
		// need to check to see if the current user has a SwitchUserGrantedAuthority
		Authentication current = this.securityContextHolderStrategy.getContext().getAuthentication();
		if (current == null) {
			throw new AuthenticationCredentialsNotFoundException(this.messages
				.getMessage("SwitchUserFilter.noCurrentUser", "No current user associated with this request"));
		}
		// check to see if the current user did actual switch to another user
		// if so, get the original source user so we can switch back
		Authentication original = getSourceAuthentication(current);
		if (original == null) {
			this.logger.debug("Failed to find original user");
			throw new AuthenticationCredentialsNotFoundException(this.messages
				.getMessage("SwitchUserFilter.noOriginalAuthentication", "Failed to find original user"));
		}
		// get the source user details
		UserDetails originalUser = null;
		Object obj = original.getPrincipal();
		if ((obj != null) && obj instanceof UserDetails) {
			originalUser = (UserDetails) obj;
		}
		// publish event
		if (this.eventPublisher != null) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Redirect unauthenticated users to the login page before exposing the switch-back link
2. Render the 'exit impersonation' link only when the current authentication exists and contains a SwitchUserGrantedAuthority
3. Check filter ordering so authentication is established before SwitchUserFilter processes the exit request
4. Increase session timeout or warn users before session expiry during impersonation

Example fix

// before (link always rendered)
<a th:href="@{/logout/impersonate}">Switch back</a>
// after (only when switched)
<a th:if="${#authorization != null and #authentication.authorities.?[authority.startsWith('ROLE_PREVIOUS_AUTHENTICATION')].size() > 0}"
   th:href="@{/logout/impersonate}">Switch back</a>

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
if (auth == null || !auth.isAuthenticated()) {
    response.sendRedirect("/login");
    return; // skip switch-back handling entirely
}

boolean hasCurrentUser(Authentication a) {
    return a != null && a.isAuthenticated() && !(a instanceof AnonymousAuthenticationToken);
}

try {
    filter.doFilter(request, response);
} catch (AuthenticationCredentialsNotFoundException e) {
    if (request.getRequestURI().equals("/logout/impersonate")) {
        response.sendRedirect("/login");
        return;
    }
    throw e;
}

When it happens

Trigger: A request hits the exit-user URL (default /logout/impersonate) while SecurityContextHolder.getContext().getAuthentication() returns null — e.g. no session, expired session, or the filter runs before authentication is established.

Common situations: User's session expired while impersonating, then clicks 'switch back'; exit URL hit directly without an authenticated session; security context cleared by concurrent logout; misconfigured filter order so the switch-user filter sees no authentication.

Related errors

• SwitchUserFilter.noOriginalAuthentication
• Could not create a default ServerMaximumSessionsExceededHand
• A ReactiveSessionRegistry is needed for concurrent session m
• authorization_request_not_found
• No persistent token found for series id: <presentedSeries>

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/c3469181b428daa6. Report an issue: GitHub.