title: Failed to evaluate expression 'IS_AUTHENTICATED_ANONYMOUSLY' Spring 4
body: <p>I upgraded from Spring 3.2.3 + Hibernate 3.8.6 to Spring 4.1.6 + Hibernate 4.3 <br/>
  now have the following error.<br/>
  This is my springSecurityContext.xml:<br/>
    <br/>
  Before that I run on Java 7.
  I want to upgrade to Java 8, should I upgrade spring 4 and Hibernate
  Help me. Thank <br/></p>
  
  <pre><code>&lt;global-method-security secured-annotations="enabled"
          pre-post-annotations="enabled" /&gt;
      &lt;http auto-config="true" use-expressions="true"&gt;
          &lt;form-login login-page="/" authentication-failure-url="/?login_error=1"
              default-target-url="/pages/" /&gt;
          &lt;logout logout-url="/j_spring_logout" logout-success-url="/"
              invalidate-session="true" /&gt;
          &lt;intercept-url pattern="/pages/**" access="IS_AUTHENTICATED_REMEMBERED" /&gt;
          &lt;intercept-url pattern="/WEB-INF/pages/**" access="IS_AUTHENTICATED_REMEMBERED" /&gt;
          &lt;intercept-url pattern="/phantichtaichinh/**" access="IS_AUTHENTICATED_REMEMBERED" /&gt;
          &lt;intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
          &lt;session-management&gt;
              &lt;concurrency-control session-registry-alias="sessionRegistry"/&gt;
          &lt;/session-management&gt;
      &lt;/http&gt;
      &lt;authentication-manager alias="authenticationManager"&gt;
          &lt;authentication-provider user-service-ref="myUserDetailsService"&gt;
              &lt;password-encoder ref="passwordEncoder"&gt;
                  &lt;salt-source user-property="token" /&gt;
              &lt;/password-encoder&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
      &lt;beans:bean id="messageSource"
          class="org.springframework.context.support.ResourceBundleMessageSource"&gt;
          &lt;beans:property name="basenames"&gt;
              &lt;beans:list&gt;
                  &lt;beans:value&gt;mymessages&lt;/beans:value&gt;
              &lt;/beans:list&gt;
          &lt;/beans:property&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="myUserDetailsService" class="com.evnit.fmis.policy.model.PolicyManager"&gt;
          &lt;beans:property name="userService" ref="userService" /&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="passwordEncoder"
          class="com.evnit.fmis.policy.model.PasswordEncoderImpl"&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="LoginLoggingPolicyService"
          class="com.evnit.fmis.policy.model.LoginLoggingPolicyService" scope="session"&gt;
          &lt;beans:property name="guiLoginLoggingPolicService" ref="guiLoginLoggingPolicService" /&gt;
      &lt;/beans:bean&gt;
      &lt;aop:config&gt;
          &lt;aop:aspect id="LoginLoggingAspect" ref="LoginLoggingPolicyService"&gt;
              &lt;aop:pointcut id="authPointcut"
                  expression="execution(public org.springframework.security.core.Authentication org.springframework.security.authentication.AuthenticationProvider.authenticate(org.springframework.security.core.Authentication))" /&gt;
              &lt;aop:around pointcut-ref="authPointcut" method="loginLogging" /&gt;
          &lt;/aop:aspect&gt;
      &lt;/aop:config&gt;
      &lt;beans:bean id="concurrencyFilter"
          class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt;
          &lt;beans:property name="sessionRegistry" ref="sessionRegistry" /&gt;
          &lt;beans:property name="expiredUrl" value="/session-expired.htm" /&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="myAuthFilter"
          class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt;
          &lt;beans:property name="sessionAuthenticationStrategy"
              ref="sas" /&gt;
          &lt;beans:property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="sas"
          class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy"&gt;
          &lt;beans:constructor-arg&gt;
              &lt;beans:list&gt;
                  &lt;beans:bean
                      class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy"&gt;
                      &lt;beans:constructor-arg ref="sessionRegistry" /&gt;
                      &lt;beans:property name="maximumSessions" value="1" /&gt;
                      &lt;beans:property name="exceptionIfMaximumExceeded"
                          value="true" /&gt;
                  &lt;/beans:bean&gt;
                  &lt;beans:bean
                      class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"&gt;
                  &lt;/beans:bean&gt;
                  &lt;beans:bean
                      class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy"&gt;
                      &lt;beans:constructor-arg ref="sessionRegistry" /&gt;
                  &lt;/beans:bean&gt;
              &lt;/beans:list&gt;
          &lt;/beans:constructor-arg&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="sessionRegistry"
          class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  </code></pre>
  
  <p>Description error</p>
  
  <pre><code>java.lang.IllegalArgumentException: Failed to evaluate expression 'IS_AUTHENTICATED_ANONYMOUSLY'
      at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:14)
      at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:36)
      at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:18)
      at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:62)
      at org.springframework.security.config.http.DefaultFilterChainValidator.checkLoginPageIsntProtected(DefaultFilterChainValidator.java:191)
      at org.springframework.security.config.http.DefaultFilterChainValidator.validate(DefaultFilterChainValidator.java:36)
      at org.springframework.security.web.FilterChainProxy.afterPropertiesSet(FilterChainProxy.java:167)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1633)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1570)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:539)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
      at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
      at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
      at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
      at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
      at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
      at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
      at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
      at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
      at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
      at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5181)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398)
      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)
  Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 0): Property or field 'IS_AUTHENTICATED_ANONYMOUSLY' cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot' - maybe not public?
      at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:226)
      at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:93)
      at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:81)
      at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:131)
      at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:299)
      at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:11)
      ... 29 more
  2015-10-27 14:23:43,006 WARN   [localhost-startStop-1] XmlWebApplicationContext M[refresh] --&gt; Exception encountered during context initialization - cancelling refresh attempt
  org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'concurrencyFilter' defined in class path resource [springSecurityContext.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1101)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1046)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
      at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
      at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
      at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
      at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
      at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
      at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
      at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
      at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
      at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
      at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5181)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398)
      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)
  Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:85)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1094)
      ... 22 more
  Caused by: java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at java.lang.Class.getConstructor0(Class.java:3082)
      at java.lang.Class.getDeclaredConstructor(Class.java:2178)
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:80)
      ... 23 more
  2015-10-27 14:23:43,037 INFO   [localhost-startStop-1] RmiServiceExporter M[destroy] --&gt; Unbinding RMI service 'TransferService' from registry at port '1199'
  2015-10-27 14:23:43,037 INFO   [localhost-startStop-1] LocalContainerEntityManagerFactoryBean M[destroy] --&gt; Closing JPA EntityManagerFactory for persistence unit 'fmis2'
  2015-10-27 14:23:43,037 ERROR  [localhost-startStop-1] ContextLoader M[initWebApplicationContext] --&gt; Context initialization failed
  org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'concurrencyFilter' defined in class path resource [springSecurityContext.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1101)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1046)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
      at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
      at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
      at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
      at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
      at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
      at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
      at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
      at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
      at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
      at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5181)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398)
      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)
  Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:85)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1094)
      ... 22 more
  Caused by: java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at java.lang.Class.getConstructor0(Class.java:3082)
      at java.lang.Class.getDeclaredConstructor(Class.java:2178)
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:80)
      ... 23 more
  Oct 27, 2015 2:23:43 PM org.apache.catalina.core.StandardContext listenerStart
  SEVERE: Exception sending context initialized event to listener instance of class org.springframework.web.context.ContextLoaderListener
  org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'concurrencyFilter' defined in class path resource [springSecurityContext.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1101)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1046)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
      at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
      at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
      at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
      at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
      at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
      at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
      at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
      at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
      at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
      at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5181)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398)
      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)
  Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:85)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1094)
      ... 22 more
  Caused by: java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.&lt;init&gt;()
      at java.lang.Class.getConstructor0(Class.java:3082)
      at java.lang.Class.getDeclaredConstructor(Class.java:2178)
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:80)
      ... 23 more
  </code></pre>