Submit Feedback
Legacy Knowledge Base
Published Sep. 10, 2025

User 0 is not allowed to access - warning traces

Written By

Ankit Gupta

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

Whenever the user is trying to log in, they are getting the below warnings:

2019-03-22 07:13:52.951 WARN [http-nio-8080-exec-366][SecurityPortletContainerWrapper:363] User 0 is not allowed to access URL http://localhos:8080/web/guest/home and portlet com_liferay_login_web_portlet_LoginPortlet

Environment

  • Liferay DXP 7.0
  • Liferay DXP 7.1
  • Liferay DXP 7.2
  • Liferay DXP 7.3

Resolution

The warning is produced in case the incoming request has an incorrect CSRF token due to a CSRF attack, but sometimes this is just a false positive, usually produced when:

Case 1: a crawler bot is trying to downloading the login page, but its request is rejected because it contains no CSRF token and no session cookie.

  • To solve this problem you can request to the Liferay support service a hotfix for the issue LPS-75442 or install a fixpack that contains the solution to this issue. This LPS avoids writing the WARN traces in case the request has no session cookie.
  • If you don't want to patch your system, you can also try excluding the problematic files to be indexed by the crawler bots using the robots.txt file, for more information see: https://www.robotstxt.org/

Case 2: the "extend session" functionality is not working correctly and the final user session is expired, so when they try to log in, they have the wrong CSRF token from the previous session.

  • To solve this problem, you have to double-check that the session.timeout Liferay portal.properties has the same value as the session timeout configured in your application server.
  • You have also check that the session.timeout.auto.extend.offset is greater than 60 seconds to avoid having problems with the chrome javascript intensive throttling
  • It is also advisable to request to the Liferay support service a hotfix for the issues:

Additional Information

Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?