diff --git a/web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java b/web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java
index 1916092640..5f05019432 100644
--- a/web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java
+++ b/web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java
@@ -21,6 +21,7 @@ import static org.mockito.Mockito.*;
 
 import org.junit.*;
 import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.access.AccessDecisionManager;
@@ -178,6 +179,18 @@ public class FilterSecurityInterceptorTests {
 		assertThat(SecurityContextHolder.getContext().getAuthentication()).isSameAs(token);
 	}
 
+	@Test
+	// gh-4997
+	public void doFilterWhenObserveOncePerRequestThenAttributeNotSet() throws Exception {
+		this.interceptor.setObserveOncePerRequest(false);
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		MockHttpServletRequest request = new MockHttpServletRequest();
+
+		this.interceptor.doFilter(request, response, new MockFilterChain());
+
+		assertThat(request.getAttributeNames().hasMoreElements()).isFalse();
+	}
+
 	private FilterInvocation createinvocation() {
 		MockHttpServletResponse response = new MockHttpServletResponse();
 		MockHttpServletRequest request = new MockHttpServletRequest();