How do I enable logging for Spring Security?

Assuming you're using Spring Boot, another option is to put the following in your application.properties:

logging.level.org.springframework.security=DEBUG 

This is the same for most other Spring modules as well.

If you're not using Spring Boot, try setting the property in your logging configuration, e.g. logback.

Here is the application.yml version as well:

logging: level: org: springframework: security: DEBUG 

You can easily enable debugging support using an option for the @EnableWebSecurity annotation:

@EnableWebSecurity(debug = true) public class SecurityConfiguration extends WebSecurityConfigurerAdapter { … } 

Basic debugging using Spring's DebugFilter can be configured like this:

@EnableWebSecurity public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { @Override public void configure(WebSecurity web) throws Exception { web.debug(true); } } 

You can easily enable debugging support using an option for the @EnableWebSecurity annotation:

@EnableWebSecurity(debug = true) public class SecurityConfiguration extends WebSecurityConfigurerAdapter { // ... } 

If you need profile-specific control the in your application-{profile}.properties file

org.springframework.security.config.annotation.web.builders.WebSecurity.debugEnabled=false 

Get Detailed Post: http://www.bytefold.com/enable-disable-profile-specific-spring-security-debug-flag/

Using Spring Boot with default spring security filters (without customizing anything, and without even setting debug in the EnableWebSecurity annotation), setting TRACE as the following application.properties shows:

logging.level.org.springframework.security=TRACE 

Is enough for it to show in detail what filters are being called and what they are doing.

TRACE w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists TRACE w.c.HttpSessionSecurityContextRepository : Created SecurityContextImpl [Null authentication] DEBUG w.c.HttpSessionSecurityContextRepository : Created HttpSession as SecurityContext is non-default ... DEBUG o.s.security.web.FilterChainProxy : Securing POST /api/product/productname01 TRACE o.s.security.web.FilterChainProxy : Invoking WebAsyncManagerIntegrationFilter (1/16) ... TRACE o.s.security.web.FilterChainProxy : Invoking CsrfFilter (5/16) DEBUG o.s.security.web.csrf.CsrfFilter : Invalid CSRF token found for http://localhost/api/product/productname01 DEBUG o.s.s.w.access.AccessDeniedHandlerImpl : Responding with 403 status code 

Versions:

Spring Framework Bom version 5.3.16 Spring Boot 2.6.4 Spring 5.3.16 Spring Security 5.6.2 

We can always check the registered filters inside Spring Security with the below configuration

1. @EnableWebSecurity(debug=true) - We need to enable the debugging of the security details
2. Enable logging of the details by adding the below property in the application.properties logging.level.org.springframework.security.web.FilterChainProxy=DEBUG

Below mentioning some of the internal filters of Spring Security that gets executed in the authentication flow:

Security filter chain: [ CharacterEncodingFilter WebAsyncManagerIntegrationFilter SecurityContextPersistenceFilter HeaderWriterFilter CsrfFilter LogoutFilter X509AuthenticationFilter UsernamePasswordAuthenticationFilter RequestCacheAwareFilter SecurityContextHolderAwareRequestFilter RememberMeAuthenticationFilter AnonymousAuthenticationFilter SessionManagementFilter ExceptionTranslationFilter FilterSecurityInterceptor ] 

You have two options:

1. Set the logging level of Spring Security to debug or trace:

application.yml:

logging: level: org: springframework: security: debug # or trace 

application.properties:

logging.level.org.springframework.security=debug 

2. Enable the Spring Security debug mode

@Configuration @EnableWebSecurity public class SecurityConfig { @Bean public WebSecurityCustomizer webSecurityCustomizer() { return web -> web.debug(true); } } 

or like this:

@Configuration @EnableWebSecurity(debug = true) public class SecurityConfig { } 

Spring security logging for webflux reactive apps is now available starting with version 5.4.0-M2 (as mentionned by @bzhu in comment How do I enable logging for Spring Security?)

Until this gets into a GA release, here is how to get this milestone release in gradle

repositories { mavenCentral() if (!version.endsWith('RELEASE')) { maven { url "https://repo.spring.io/milestone" } } } // Force earlier milestone release to get securing logging preview // https://docs.spring.io/spring-security/site/docs/current/reference/html5/#getting-gradle-boot // https://github.com/spring-projects/spring-security/pull/8504 // https://github.com/spring-projects/spring-security/releases/tag/5.4.0-M2 ext['spring-security.version']='5.4.0-M2' dependencyManagement { imports { mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}" } } 

Put the following in your application.properties:

logging.level.org.springframework.security=DEBUG 

To know the roles of the user you can use the following code

@RestController public class DemoController { //.... @GetMapping("/roles") public List<String> getUserRoles() { List<String> roles = rolesUser(); return roles; } private List<String> rolesUser() { Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); List<GrantedAuthority> authorities = (List<GrantedAuthority>) authentication.getAuthorities(); List<String> roles = authorities.stream() .map(GrantedAuthority::getAuthority) .collect(Collectors.toList()); return roles; } }