I created https://github.com/spring-projects/spring-security/pull/10235 Use ApplicationContext as parent MessageSource of SpringSecurityMessageSource

SpringSecurityMessageSource messageSource = new SpringSecurityMessageSource();
messageSource.setParentMessageSource(parent);
messageSource.setUseCodeAsDefaultMessage(true);
return new MessageSourceAccessor(messageSource);

It will works fine, but we can not customize spring security messages since it always search org.springframework.security.messages first, I think AbstractMessageSource should introduce a method to indicate searching from parent first just like class loader.

Comment From: snicoll

@quaff thanks but we don't need both an issue and a PR.

Duplicates #27367