title: Spring Security: MessageSource not initialized - call 'refresh' before accessing messages via the context
body: <p>I know the reason for this error (probably, this is either configuration issue, or more realistically springframework/spring security issue), but I don't know how to fix it.</p>
  
  <p>Here is the stack trace (only the cause classes are included):</p>
  
  <pre><code>...
  at org.springframework.context.support.AbstractApplic ationContext.getMessageSource(AbstractApplicationC ontext.java:1224)
  at org.springframework.context.support.AbstractApplic ationContext.getMessage(AbstractApplicationContext .java:1206)
  at org.springframework.context.support.MessageSourceA ccessor.getMessage(MessageSourceAccessor.java:83)
  at org.springframework.security.access.vote.Affirmati veBased.decide(AffirmativeBased.java:83)
  at org.springframework.security.config.http.DefaultFi lterChainValidator.checkLoginPageIsntProtected(DefaultFilterChainValidator.java:170)
  at org.springframework.security.config.http.DefaultFi lterChainValidator.validate(DefaultFilterChainValidator.java:35)
  at org.springframework.security.web.FilterChainProxy. afterPropertiesSet(FilterChainProxy.java:148)
  ...
  </code></pre>
  
  <p>The reason for this is the following:</p>
  
  <ol>
  <li>/signin URL is protected, so DefaultFilterChainValidator.checkLoginPageIsntProt ected() is failed, and</li>
  <li><p>AffirmativeBased.decide() tries to throw the exception:</p>
  
  <pre><code>...
  if (deny &gt; 0) {
  throw new AccessDeniedException(messages.getMessage("AbstractAccessDecisionManager.accessDenied",
  "Access is denied"));
  }
  ...
  </code></pre></li>
  <li><p>Here message is extracted, and SpringSecurityMessageSource class is used for this purpose:</p>
  
  <pre><code>public class SpringSecurityMessageSource extends ResourceBundleMessageSource {
  
  
  public SpringSecurityMessageSource() {
  setBasename("org.springframework.security.messages ");
  }
  
  public static MessageSourceAccessor getAccessor() {
      return new MessageSourceAccessor(new SpringSecurityMessageSource());
  }
  }
  </code></pre></li>
  </ol>
  
  <p>And actually if AbstractAccessDecisionManager didn't implement MessageSourceAware everything should work, because (see the attached screenshot), by unknown reason XmlWebApplicationContext is trying to rewrite the valid initialized MessageSourceAccessor (again see the screenshot) (yes, XmlWebApplicationContext implements MessageSource actually), but this behavior is weird (or do I miss something?).</p>
  
  <p>And, of course, after this initialization messageSource is null, and the required message can't be retrieved.</p>
  
  <p>This specific issue can be fixed by providing access (permitAll) to /signin (what really must be done), but this is not case, the case is how to fix this, that in the case of the error I could see the detailed message, and org.springframework.security.message would be used and not overridden.</p>
  
  <p>And final note, &lt;debug/&gt; is used, just if you are interested. I use spring security 3.1.0.RELEASE and spring framework 3.1.0.RELEASE.
  <img src="https://i.stack.imgur.com/jXzD6.png" alt="Spring Security MessageSource"></p>