spring-projects/spring-security · warning

The login page is being protected by the filter chain, but y

Error message

The login page is being protected by the filter chain, but you don't appear to have anonymous authentication enabled. This is almost certainly an error.

What it means

DefaultFilterChainValidator.checkLoginPageIsntProtected verifies that the configured login page can be reached without authentication. If no AnonymousAuthenticationFilter is present in the chain and the login page is not otherwise public, it warns that the login page is protected by the filter chain without anonymous authentication, which almost always breaks login (redirect loop back to the login page). This is a logged warning, not an exception.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java:226

			// May happen legitimately if a filter-chain request matcher requires more
			// request data than that provided
			// by the dummy request used when creating the filter invocation.
			this.logger.info("Failed to obtain filter chain information for the login page. Unable to complete check.");
		}
		if (filters == null || filters.isEmpty()) {
			this.logger.debug("Filter chain is empty for the login page");
			return;
		}
		if (getFilter(DefaultLoginPageGeneratingFilter.class, filters) != null) {
			this.logger.debug("Default generated login page is in use");
			return;
		}
		if (checkLoginPageIsPublic(filters, loginRequest)) {
			return;
		}
		AnonymousAuthenticationFilter anonymous = getFilter(AnonymousAuthenticationFilter.class, filters);
		if (anonymous == null) {
			this.logger.warn("The login page is being protected by the filter chain, but you don't appear to have"
					+ " anonymous authentication enabled. This is almost certainly an error.");
			return;
		}
		// Simulate an anonymous access with the supplied attributes.
		AnonymousAuthenticationToken token = new AnonymousAuthenticationToken("key", anonymous.getPrincipal(),
				anonymous.getAuthorities());
		Supplier<Boolean> check = deriveAnonymousCheck(filters, loginRequest, token);
		try {
			boolean allowed = check.get();
			if (!allowed) {
				this.logger.warn("Anonymous access to the login page doesn't appear to be enabled. "
						+ "This is almost certainly an error. Please check your configuration allows unauthenticated "
						+ "access to the configured login page. (Simulated access was rejected)");
			}
		}
		catch (Exception ex) {
			// May happen legitimately if a filter-chain request matcher requires more
			// request data than that provided

View on GitHub (pinned to 96852e8860)

Solutions

1. Re-enable anonymous authentication: remove anonymous().disable() / restore the AnonymousAuthenticationFilter.
2. Add an explicit permitAll rule for the login page: authorizeHttpRequests().requestMatchers("/login").permitAll().
3. Verify the configured loginPage URL matches the actual protected-request matcher (context path included).
4. Ensure a LoginUrlAuthenticationEntryPoint is used so unauthenticated users are redirected, not rejected.

Example fix

// before
http.authorizeHttpRequests(a -> a.anyRequest().authenticated())
    .formLogin(f -> f.loginPage("/login"))
    .anonymous(a -> a.disable());
// after
http.authorizeHttpRequests(a -> a.requestMatchers("/login").permitAll()
        .anyRequest().authenticated())
    .formLogin(f -> f.loginPage("/login"));

// assert login page is permitted in tests
mockMvc.perform(get("/login"))
    .andExpect(status().isOk());

When it happens

Trigger: Calling validate() on a FilterChainProxy when: a login page is configured (formLogin().loginPage(...)), the page's request matcher is not matched by any permitAll rule, and the filter chain lacks AnonymousAuthenticationFilter (anonymous().disabled() or filter removed).

Common situations: Disabling anonymous authentication while using a custom login page; a permitAll rule whose matcher does not actually cover the login URL (typo, wrong HTTP method, context-path mismatch); copying a config that removed anonymous support.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Anonymous access to the login page doesn't appear to be enab
• The Filter class {registeredFilter.getName()} does not have
• The Filter class {filter.getClass().getName()} does not have
• A filter chain that matches any request [{anyRequestFilterCh
• The FilterChainProxy contains two filter chains using the ma

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/7caf92e3f6f61e3f. Report an issue: GitHub.