search

spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.85k stars 5.91k forks source link

Improve Error Message for Conflicting Filter Chains #15992

Closed jzheaux closed 2 weeks ago

jzheaux commented 1 month ago

This adds BeanNameAware to DefaultSecurityFilterChain to improve the information it can provide to logs.

A sample improved message looks like this:

A filter chain that matches any request [DefaultSecurityFilterChain defined as 'api1' in [org.example.FilterChainConfig] matching [any request] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, HeaderWriter, Csrf, Logout, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, ExceptionTranslation, Authorization]] has already been configured, which means that this filter chain [DefaultSecurityFilterChain defined as 'api2' in [org.example.FilterChainConfig] matching [Or [Mvc [pattern='/app/**']]] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, HeaderWriter, Csrf, Logout, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, ExceptionTranslation, Authorization]] will never get invoked. Please use HttpSecurity#securityMatcher to ensure that there is only one filter chain configured for 'any request' and that the 'any request' filter chain is published last.

Closes gh-15874