spring-projects/spring-security · warning

You are asking Spring Security to ignore %s. This is not rec

Error message

You are asking Spring Security to ignore %s. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.

What it means

WebSecurity.performBuild() builds one-pass SecurityFilterChains for each request matcher registered via WebSecurity.ignoring(). Because ignored requests bypass the entire filter chain (no security at all), Spring Security logs this warning pointing developers to authorizeHttpRequests with permitAll, which keeps the security filters (headers, CSRF, context, etc.) running while still permitting access.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java:317

		Assert.notNull(requestRejectedHandler, "requestRejectedHandler cannot be null");
		this.requestRejectedHandler = requestRejectedHandler;
		return this;
	}

	@Override
	protected Filter performBuild() {
		Assert.state(!this.securityFilterChainBuilders.isEmpty(),
				() -> "At least one SecurityBuilder<? extends SecurityFilterChain> needs to be specified. "
						+ "Typically this is done by exposing a SecurityFilterChain bean. "
						+ "More advanced users can invoke " + WebSecurity.class.getSimpleName()
						+ ".addSecurityFilterChainBuilder directly");
		int chainSize = this.ignoredRequests.size() + this.securityFilterChainBuilders.size();
		List<SecurityFilterChain> securityFilterChains = new ArrayList<>(chainSize);
		RequestMatcherDelegatingAuthorizationManager.Builder builder = RequestMatcherDelegatingAuthorizationManager
			.builder();
		boolean mappings = false;
		for (RequestMatcher ignoredRequest : this.ignoredRequests) {
			WebSecurity.this.logger.warn("You are asking Spring Security to ignore " + ignoredRequest
					+ ". This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.");
			SecurityFilterChain securityFilterChain = new DefaultSecurityFilterChain(ignoredRequest);
			securityFilterChains.add(securityFilterChain);
			builder.add(ignoredRequest, SingleResultAuthorizationManager.permitAll());
			mappings = true;
		}
		for (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : this.securityFilterChainBuilders) {
			SecurityFilterChain securityFilterChain = securityFilterChainBuilder.build();
			securityFilterChains.add(securityFilterChain);
			mappings = addAuthorizationManager(securityFilterChain, builder) || mappings;
		}
		if (this.privilegeEvaluator == null) {
			AuthorizationManager<HttpServletRequest> authorizationManager = mappings ? builder.build()
					: SingleResultAuthorizationManager.permitAll();
			AuthorizationManagerWebInvocationPrivilegeEvaluator privilegeEvaluator = new AuthorizationManagerWebInvocationPrivilegeEvaluator(
					authorizationManager);
			privilegeEvaluator.setServletContext(this.servletContext);
			if (this.privilegeEvaluatorRequestTransformer != null) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Replace web.ignoring() matchers with http.authorizeHttpRequests(a -> a.requestMatchers("/css/**").permitAll()) so filters still run.
2. If the ignore is intentional for a truly non-HTTP-security path (e.g. performance-critical static serving handled by the container), keep it but document it and accept the warning.
3. Restrict ignoring() to as narrow a path set as possible and never for authenticated resources.

Example fix

// before
@Override
public void configure(WebSecurity web) {
    web.ignoring().requestMatchers("/css/**", "/js/**");
}

// after
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(a -> a.requestMatchers("/css/**", "/js/**").permitAll().anyRequest().authenticated());
}

// CI check: fail build if ignoring() appears in WebSecurityConfigurer
if (sourceCode.contains("web.ignoring()")) {
    throw new IllegalStateException("Use permitAll via authorizeHttpRequests instead of web.ignoring()");
}

When it happens

Trigger: Configuring WebSecurity with ignoring() matchers, e.g. @Override public void configure(WebSecurity web) { web.ignoring().antMatchers("/css/**"); }, or web.ignoring().requestMatchers(...). Every ignoring() entry produces one warning at startup.

Common situations: Excluding static resources from security for performance; copying legacy web.ignoring() config forward from Spring Security 3/4; trying to fix 401s on health endpoints by ignoring them entirely.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

• Anonymous access to the login page doesn't appear to be enab
• It is not recommended to use authorizeRequests or FilterSecu
• Usage of authorizeRequests and FilterSecurityInterceptor are
• Access is denied
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/0c6b1686c4f797f4. Report an issue: GitHub.