spring-projects / spring-projects/spring-security

MFA does not work with @PreAuthorize("hasAllAuthorities('FACTOR_OTT','FACTOR_PASSWORD')")

Open
#18,709 6 comments 0 reactions 1 assignee View on GitHub

@jzheaux is already working on this.

Since Feb 13, 2026.

in: core status: feedback-provided
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
I enabled MFA in the project and defined

.requestMatchers("/mfa-ott-password")
.hasAllAuthorities(FactorGrantedAuthority.PASSWORD_AUTHORITY, FactorGrantedAuthority.OTT_AUTHORITY)

in the SecurityFilterChain. When accessing the API, the request enters the AuthenticationEntryPoint due to the absence of FactorGrantedAuthority, which causes a redirect to the login page.
However, when I use @PreAuthorize("hasAllAuthorities('FACTOR_OTT','FACTOR_PASSWORD'), the request is denied with a 403 response due to insufficient authorities. It appears that FACTOR_XX is not being treated as a concrete authentication factor.
To Reproduce
As shown in the code above.

Expected behavior
Both approaches should be treated as authentication factors.
Sample
Let me know if you need it.

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.