{"record":{"id":"12714c181de2218e","repo":"spring-projects/spring-security","slug":"cannot-configure-both-a-corsconfigurationsource-an","errorCode":null,"errorMessage":"Cannot configure both a CorsConfigurationSource and a PreFlightRequestHandler on CorsConfigurer","messagePattern":"Cannot configure both a CorsConfigurationSource and a PreFlightRequestHandler on CorsConfigurer","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/configurers/CorsConfigurer.java","lineNumber":81,"sourceCode":"\n\t/**\n\t * Use the given {@link PreFlightRequestHandler} for CORS preflight requests. When\n\t * set, {@link CorsFilter} is not used. Cannot be combined with\n\t * {@link #configurationSource(CorsConfigurationSource)}.\n\t * @param preFlightRequestHandler the handler to use\n\t * @return the {@link CorsConfigurer} for additional configuration\n\t */\n\tpublic CorsConfigurer<H> preFlightRequestHandler(PreFlightRequestHandler preFlightRequestHandler) {\n\t\tthis.preFlightRequestHandler = preFlightRequestHandler;\n\t\treturn this;\n\t}\n\n\t@Override\n\tpublic void configure(H http) {\n\t\tApplicationContext context = http.getSharedObject(ApplicationContext.class);\n\n\t\tif (this.configurationSource != null && this.preFlightRequestHandler != null) {\n\t\t\tthrow new IllegalStateException(\n\t\t\t\t\t\"Cannot configure both a CorsConfigurationSource and a PreFlightRequestHandler on CorsConfigurer\");\n\t\t}\n\n\t\tCorsFilter corsFilter = getCorsFilter(context);\n\t\tif (corsFilter != null) {\n\t\t\thttp.addFilter(corsFilter);\n\t\t\treturn;\n\t\t}\n\t\tPreFlightRequestHandler preFlightRequestHandlerBean = getPreFlightRequestHandler(context);\n\t\tif (preFlightRequestHandlerBean != null) {\n\t\t\thttp.addFilterBefore(new PreFlightRequestFilter(preFlightRequestHandlerBean), CorsFilter.class);\n\t\t\treturn;\n\t\t}\n\t\tthrow new NoSuchBeanDefinitionException(CorsConfigurationSource.class,\n\t\t\t\t\"Failed to find a bean that implements `CorsConfigurationSource`. Please ensure that you are using \"\n\t\t\t\t\t\t+ \"`@EnableWebMvc`, are publishing a `WebMvcConfigurer`, or are publishing a `CorsConfigurationSource` bean.\");\n\t}\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/configurers/CorsConfigurer.java#L63-L99","documentation":"Spring Security's CorsConfigurer only allows one CORS configuration mechanism at a time: an explicit CorsConfigurationSource OR a PreFlightRequestHandler, never both. During HttpSecurity configuration, configure() detects both fields being non-null and aborts with IllegalStateException. This is a configuration-conflict guard, not a runtime failure.","triggerScenarios":"Calling http.cors() with .configurationSource(source) AND .preFlightRequestHandler(handler) on the same CorsConfigurer instance in one HttpSecurity chain.","commonSituations":"Copy-pasting two different CORS setups into one config class; merging two branches' security configs; following an old tutorial plus a new Spring Security 6.x pre-flight example in the same builder chain.","solutions":["Keep only one of .configurationSource() or .preFlightRequestHandler() on the http.cors() chain","If you need custom pre-flight behavior, move it into a custom CorsConfigurationSource (which returns the configuration the CorsFilter uses) instead of a separate handler","If both beans exist in the context and are being picked up, remove the unused bean or don't set both explicitly via the configurer"],"exampleFix":"// before\nhttp.cors(c -> c.configurationSource(source).preFlightRequestHandler(handler));\n// after\nhttp.cors(c -> c.configurationSource(source));","handlingStrategy":"validation","validationCode":"// before building HttpSecurity\nassert !(corsConfigurerHasConfigurationSource() && corsConfigurerHasPreFlightRequestHandler())\n    : \"Set only one of configurationSource / preFlightRequestHandler\";","typeGuard":"boolean isCorsConfigValid(CorsConfigurer<HttpSecurity> c) {\n    return !(c.hasConfigurationSource() && c.hasPreFlightRequestHandler());\n}","tryCatchPattern":null,"preventionTips":["Configure CORS through a single mechanism only (prefer CorsConfigurationSource)","Centralize HttpSecurity configuration in one @Configuration class to avoid merged duplicate CORS settings","Review code-review checklist: never chain .configurationSource() and .preFlightRequestHandler() together"],"tags":["spring-security","cors","configuration","illegal-state"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}