spring-projects/spring-security · warning

Usage of authorizeRequests and FilterSecurityInterceptor are

Error message

Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration

What it means

DefaultFilterChainValidator detects that the XML HTTP security configuration uses the deprecated authorizeRequests()/intercept-url style backed by FilterSecurityInterceptor instead of the newer authorizeHttpRequests AuthorizationFilter. It logs a warning because FilterSecurityInterceptor is deprecated and will be removed; new code should migrate to the authorizeHttpRequests model.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java:136

	private void checkAuthorizationFilters(List<SecurityFilterChain> chains) {
		Filter authorizationFilter = null;
		Filter filterSecurityInterceptor = null;
		for (SecurityFilterChain chain : chains) {
			for (Filter filter : chain.getFilters()) {
				if (filter instanceof AuthorizationFilter) {
					authorizationFilter = filter;
				}
				if (USING_ACCESS && AccessComponents.isFilterSecurityInterceptor(filter)) {
					filterSecurityInterceptor = filter;
				}
			}
			if (authorizationFilter != null && filterSecurityInterceptor != null) {
				this.logger.warn(
						"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests");
			}
			if (filterSecurityInterceptor != null) {
				this.logger.warn(
						"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration");
			}
			authorizationFilter = null;
			filterSecurityInterceptor = null;
		}
	}

	@SuppressWarnings({ "unchecked" })
	private static <F extends Filter> F getFilter(Class<F> type, List<Filter> filters) {
		for (Filter f : filters) {
			if (type.isAssignableFrom(f.getClass())) {
				return (F) f;
			}
		}
		return null;
	}

	/**

View on GitHub (pinned to 96852e8860)

Solutions

Migrate XML authorization rules to authorizeHttpRequests (Java DSL or XmlHttpRequestDsl) and remove <intercept-url>/FilterSecurityInterceptor
If staying on XML, move rules into an AuthorizationManager-backed configuration and ensure the chain uses AuthorizationFilter
If the warning must remain temporarily, verify both FilterSecurityInterceptor and AuthorizationFilter are not combined inconsistently and suppress noise until migration

Example fix

// before (XML style)
<http>
  <intercept-url pattern="/admin/**" access="hasRole('ADMIN')"/>
</http>
// after
http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .anyRequest().authenticated());

Defensive patterns

Strategy: validation

Validate before calling

// At startup, scan FilterChainProxy filters
boolean usesFsi = filterChainProxy.getFilters("/").stream()
    .anyMatch(f -> f instanceof FilterSecurityInterceptor);
if (usesFsi) { planMigrationToAuthorizeHttpRequests(); }

Prevention

Prefer the authorizeHttpRequests Java DSL for all new security configs
Audit XML <http> blocks for <intercept-url> usage during upgrades
Watch Spring Security deprecation warnings in CI logs

When it happens

Trigger: Parsing an XML <http> security configuration whose filter chain contains a FilterSecurityInterceptor (from <intercept-url>/authorizeRequests) without a matching AuthorizationFilter, during validation of the built FilterChainProxy.

Common situations: Legacy XML-based Spring Security configs upgraded to Spring Security 5.x/6.x; teams keeping intercept-url rules instead of porting to authorizeHttpRequests; partially migrated configs mixing old and new authorization styles.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/34941255cfe36959. Report an issue: GitHub.