spring-projects/spring-security · warning

Usage of authorizeRequests and FilterSecurityInterceptor are

Error message

Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration

What it means

During startup validation, WebSecurityFilterChainValidator.checkAuthorizationFilters() logs this warning whenever a SecurityFilterChain still contains a FilterSecurityInterceptor, i.e. the configuration uses the deprecated authorizeRequests()/interceptor model. Unlike error 696, this fires for FilterSecurityInterceptor even without an AuthorizationFilter in the same chain, and states that the mechanism is deprecated.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurityFilterChainValidator.java:109

	private void checkAuthorizationFilters(List<SecurityFilterChain> chains) {
		Filter authorizationFilter = null;
		Filter filterSecurityInterceptor = null;
		for (SecurityFilterChain chain : chains) {
			for (Filter filter : chain.getFilters()) {
				if (filter instanceof AuthorizationFilter) {
					authorizationFilter = filter;
				}
				if (USING_ACCESS && AccessComponents.isFilterSecurityInterceptor(filter)) {
					filterSecurityInterceptor = filter;
				}
			}
			if (authorizationFilter != null && filterSecurityInterceptor != null) {
				this.logger.warn(
						"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests");
			}
			if (filterSecurityInterceptor != null) {
				this.logger.warn(
						"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration");
			}
			authorizationFilter = null;
			filterSecurityInterceptor = null;
		}
	}

	private static final class AccessComponents {

		private static boolean isFilterSecurityInterceptor(Filter filter) {
			return filter instanceof FilterSecurityInterceptor;
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

Migrate to http.authorizeHttpRequests(...) and delete the authorizeRequests() configuration.
Replace explicit FilterSecurityInterceptor beans with AuthorizationFilter and an AuthorizationManager.
If migration must wait, isolate the legacy chain and plan removal, since FilterSecurityInterceptor is slated for deletion.

Example fix

// before
http.authorizeRequests(a -> a.antMatchers("/public/**").permitAll().anyRequest().authenticated());

// after
http.authorizeHttpRequests(a -> a.requestMatchers("/public/**").permitAll().anyRequest().authenticated());

Defensive patterns

Strategy: validation

Validate before calling

boolean legacy = chain.getFilters().stream()
    .anyMatch(f -> f instanceof FilterSecurityInterceptor);
if (legacy) {
    throw new IllegalStateException("FilterSecurityInterceptor is deprecated; migrate to authorizeHttpRequests");
}

Prevention

Plan the authorizeRequests -> authorizeHttpRequests migration before upgrading to Spring Security 6.
Replace custom FilterSecurityInterceptor beans with AuthorizationFilter + AuthorizationManager.
Monitor startup logs for deprecation warnings in CI so regressions are caught.

When it happens

Trigger: Any validated SecurityFilterChain where AccessComponents.isFilterSecurityInterceptor(filter) matches a filter — produced by http.authorizeRequests(...) or explicitly added FilterSecurityInterceptor beans — when WebSecurityFilterChainValidator.validate() runs at startup.

Common situations: Upgrading Spring Security 5.x to 6.x while keeping authorizeRequests configs; legacy XML <http> security; third-party integrations that still register FilterSecurityInterceptor.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/398f1bddaf4a0936. Report an issue: GitHub.