spring-projects / spring-projects/spring-security
MFA does not work with @PreAuthorize("hasAllAuthorities('FACTOR_OTT','FACTOR_PASSWORD')")
@jzheaux is already working on this.
Since Feb 13, 2026.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
I enabled MFA in the project and defined
.requestMatchers("/mfa-ott-password")
.hasAllAuthorities(FactorGrantedAuthority.PASSWORD_AUTHORITY, FactorGrantedAuthority.OTT_AUTHORITY)
in the SecurityFilterChain. When accessing the API, the request enters the AuthenticationEntryPoint due to the absence of FactorGrantedAuthority, which causes a redirect to the login page.
However, when I use @PreAuthorize("hasAllAuthorities('FACTOR_OTT','FACTOR_PASSWORD'), the request is denied with a 403 response due to insufficient authorities. It appears that FACTOR_XX is not being treated as a concrete authentication factor.
To Reproduce
As shown in the code above.
Expected behavior
Both approaches should be treated as authentication factors.
Sample
Let me know if you need it.
Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.