Error when using @EnableWebFluxSecurity in spring-boot

Question

I am trying to setup a simple spring boot application. It can be started if I don't use @EnableWebFluxSecurity annotatoin.

    @Configuration
    @EnableWebFluxSecurity
    open class ArticleWebSecurityConfig {

        @Bean
        open fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain = http
            .csrf().disable()
            .authorizeExchange()
            .anyExchange()
            .permitAll()
            .and()
            .build()
    }

The following error occurrs when I start it:

ConfigServletWebServerApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'defaultSecurityFilterChain' defined in class path resource [org/springframework/boot/autoconfigure/security/servlet/SpringBootWebSecurityConfiguration.class]: Unsatisfied dependency expressed through method 'defaultSecurityFilterChain' parameter 0; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type 'org.springframework.security.config.annotation.web.builders.HttpSecurity' available: expected at least 1 bean which qualifies as autowire candidate. Dependency annotations: {}

Description

Parameter 0 of method defaultSecurityFilterChain in org.springframework.boot.autoconfigure.security.servlet.SpringBootWebSecurityConfiguration required a bean of type 'org.springframework.security.config.annotation.web.builders.HttpSecurity' that could not be found.

Action:

Consider defining a bean of type 'org.springframework.security.config.annotation.web.builders.HttpSecurity' in your configuration.

Process finished with exit code 1

I used the following @Bean but stil get the same errror.

    @Throws(Exception::class)
    @Bean
    open fun configure(http: HttpSecurity) {
        http
            .authorizeRequests()
            .anyRequest()
            .authenticated()
            .and()
            .httpBasic()
    }

These are my dependencies

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webflux</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jetty</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>

the "configure" bean expects an autowired HttpSecurity bean as its parameter. you need to define an HttpSecurity bean, you can do it in the same class. — Tom Elias, Aug 09 '21 at 15:47
@TomElias Could you please answer this question? I did not get what you really mean. — mahan, Aug 09 '21 at 16:05

Andreas Dedousis · Answer 1 · 2022-12-15T14:31:23.350

I had the same issue.Some of your dependencies are bringing spring-boot-starter-web. You need to find who using mvn dependency:tree and exclude it in your pom.xml.

<exclusions>
    <exclusion>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </exclusion>
 </exclusions>

And also add as seperate dependecy the

<dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
</dependency>

Also another addition you should make is add : spring.main.web-application-type=reactive in application properties

score 0 · Answer 2 · answered Aug 09 '21 at 15:38

0

You need to add both @EnableWebFluxSecurity and @Configuration according to this answer.

answered Aug 09 '21 at 15:38

gcpdev

442
6
20

No, it does not work. I just updatd my question. – mahan Aug 09 '21 at 15:42

score 0 · Answer 3 · answered Jul 24 '23 at 09:14

0

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
        </dependency>

Adding above dependency solved it for me. Using Spring 6, Boot 3, Java 17.

answered Jul 24 '23 at 09:14

André Jakobsson

56
4

Error when using @EnableWebFluxSecurity in spring-boot

Description

3 Answers3