OpenAPITools/openapi-generator · error · IllegalArgumentException

useSpringSecurityPreAuthorize is only supported with the spr

Error message

useSpringSecurityPreAuthorize is only supported with the spring-boot library

What it means

Thrown during Spring generator option processing when useSpringSecurityPreAuthorize=true but the active library is not spring-boot. The option makes templates emit @PreAuthorize annotations from Spring Security, and those are only wired into the server-stub templates of the spring-boot library. HTTP-interface or other client libraries cannot carry method-level security metadata.

Source

Thrown at modules/openapi-generator/src/main/java/org/openapitools/codegen/languages/SpringCodegen.java:657

        convertPropertyToBooleanAndWriteBack(USE_ENUM_CASE_INSENSITIVE, this::setUseEnumCaseInsensitive);
        convertPropertyToBooleanAndWriteBack(USE_JACKSON_3, this::setUseJackson3);
        convertPropertyToBooleanAndWriteBack(USE_SPRING_BOOT3, this::setUseSpringBoot3);
        convertPropertyToBooleanAndWriteBack(USE_SPRING_BOOT4, this::setUseSpringBoot4);

        if (isUseSpringBoot4()) {
            setUseSpringBoot3(false);
        }
        if (isNotEmpty(clientRegistrationId)) {
            if (!SPRING_HTTP_INTERFACE.equals(library)) {
                throw new IllegalArgumentException(CLIENT_REGISTRATION_ID + " is only supported with the " + SPRING_HTTP_INTERFACE + " library");
            }
            if (!isUseSpringBoot4()) {
                throw new IllegalArgumentException(CLIENT_REGISTRATION_ID + " requires " + USE_SPRING_BOOT4 + "=true because @ClientRegistrationId is provided by Spring Security 7");
            }
        }
        if (useSpringSecurityPreAuthorize && !SPRING_BOOT.equals(library)) {
            throw new IllegalArgumentException(USE_SPRING_SECURITY_PRE_AUTHORIZE
                    + " is only supported with the " + SPRING_BOOT + " library");
        }

        if (isUseSpringBoot3() || isUseSpringBoot4()) {
            if (AnnotationLibrary.SWAGGER1.equals(getAnnotationLibrary())) {
                throw new IllegalArgumentException(AnnotationLibrary.SWAGGER1.getPropertyName() + " is not supported with Spring Boot > 3.x");
            }
            useJakartaEe = true;
            applyJakartaPackage();
        }
        if(isUseJackson3() && !isUseSpringBoot4()){
            throw new IllegalArgumentException("useJackson3 is only available with Spring Boot >= 4");
        }
        if(this.useJackson3){
            this.applyJackson3Package();
        } else {
            this.applyJackson2Package();
        }

View on GitHub (pinned to fcec517be3)

Solutions

Remove useSpringSecurityPreAuthorize when generating spring-http-interface clients (security belongs to the server).
Or keep the option and set --library=spring-boot, the only library that supports it.
Audit shared generator configs for server-only options before reusing them for clients.

Example fix

// before (openapi-generator-maven-plugin config)
<library>spring-http-interface</library>
<configOptions>
  <useSpringSecurityPreAuthorize>true</useSpringSecurityPreAuthorize>
</configOptions>

// after
<library>spring-http-interface</library>
<!-- option removed -->

Defensive patterns

Strategy: validation

Validate before calling

# bash: reject server-only options on client libraries
if [ "$USE_SPRING_SECURITY_PRE_AUTHORIZE" = "true" ] && [ "$LIBRARY" != "spring-boot" ]; then
  echo "useSpringSecurityPreAuthorize requires library=spring-boot" >&2; exit 1
fi

Try / catch

// Java
try {
    config.setUseSpringSecurityPreAuthorize(true); // only when library == spring-boot
    new DefaultGenerator().opts(input).generate();
} catch (IllegalArgumentException e) {
    // configuration error: surface message, correct options; never retry unchanged
}

Prevention

Maintain separate option presets for server (spring-boot) and client (spring-http-interface) generation.
Add a config linter step that rejects known library-unsupported option combinations.
Document which options are template-scoped when onboarding new generators.

When it happens

Trigger: -g spring with --library=spring-http-interface (or any library other than spring-boot) combined with -DuseSpringSecurityPreAuthorize=true.

Common situations: Switching a project from the spring-boot library to spring-http-interface and leaving the security option in the generator config; pasting a full option list from a server project into a client generation job; CI pipelines that share one options file across generators.

Related errors

AI-assisted analysis of OpenAPITools/openapi-generator@fcec517be3 (2026-08-22). Data as JSON: /api/errors/922c6f8a0371e0e9. Report an issue: GitHub.