{"record":{"id":"323ac9c22916dea0","repo":"spring-projects/spring-security","slug":"a-bean-named-mvchandlermappingintrospector-of-type-323ac9","errorCode":null,"errorMessage":"A Bean named mvcHandlerMappingIntrospector of type org.springframework.web.cors.CorsConfigurationSource is required to use <cors>. Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext.","messagePattern":"A Bean named mvcHandlerMappingIntrospector of type org\\.springframework\\.web\\.cors\\.CorsConfigurationSource is required to use <cors>\\. Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext\\.","errorType":"exception","errorClass":"NoSuchBeanDefinitionException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/CorsFilterFactoryBean.java","lineNumber":50,"sourceCode":"class CorsFilterFactoryBean implements FactoryBean<Filter>, ApplicationContextAware {\n\n\tprivate static final String HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = \"mvcHandlerMappingIntrospector\";\n\n\tprivate ApplicationContext context;\n\n\t@Override\n\tpublic Filter getObject() {\n\t\tif (this.context.containsBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {\n\t\t\tCorsConfigurationSource source = this.context.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,\n\t\t\t\t\tCorsConfigurationSource.class);\n\t\t\treturn new CorsFilter(source);\n\t\t}\n\t\tString[] preFlightRequestHandlerNames = this.context.getBeanNamesForType(PreFlightRequestHandler.class);\n\t\tif (preFlightRequestHandlerNames.length == 1) {\n\t\t\tPreFlightRequestHandler handler = this.context.getBean(PreFlightRequestHandler.class);\n\t\t\treturn new PreFlightRequestFilter(handler);\n\t\t}\n\t\tthrow new NoSuchBeanDefinitionException(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,\n\t\t\t\t\"A Bean named \" + HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME + \" of type \"\n\t\t\t\t\t\t+ CorsConfigurationSource.class.getName()\n\t\t\t\t\t\t+ \" is required to use <cors>. Please ensure Spring Security & Spring \"\n\t\t\t\t\t\t+ \"MVC are configured in a shared ApplicationContext.\");\n\t}\n\n\t@Nullable\n\t@Override\n\tpublic Class<?> getObjectType() {\n\t\treturn Filter.class;\n\t}\n\n\t@Override\n\tpublic void setApplicationContext(ApplicationContext applicationContext) throws BeansException {\n\t\tthis.context = applicationContext;\n\t}\n\n}","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/CorsFilterFactoryBean.java#L32-L68","documentation":"CorsFilterFactoryBean.getObject locates MVC's PreFlightRequestHandler (via the HandlerMappingIntrospector bean name mvcHandlerMappingIntrospector) to build the pre-flight CorsFilter. When no PreFlightRequestHandler bean exists in the context, it throws NoSuchBeanDefinitionException stating that the mvcHandlerMappingIntrospector-typed CorsConfigurationSource bean is required to use <cors>.","triggerScenarios":"getObject() is invoked (during FilterChainProxy creation for <cors/> without a source attribute) and getBeanNamesForType(PreFlightRequestHandler.class) returns zero entries because Spring MVC's HandlerMappingIntrospector is absent from the shared ApplicationContext.","commonSituations":"No Spring MVC in the classpath or context; MVC configured in a different (child/parent) ApplicationContext than the security namespace config; forgetting @EnableWebMvc or <mvc:annotation-driven/>; non-Spring-MVC stack using <cors>.","solutions":["Enable Spring MVC in the shared context with <mvc:annotation-driven/> or @EnableWebMvc so the HandlerMappingIntrospector and its PreFlightRequestHandler are registered","Co-locate security and MVC configuration in one ApplicationContext","Provide an explicit CorsConfigurationSource and reference it via <cors source=\"...\"/> to bypass MVC introspection"],"exampleFix":"// before (security config in root context, MVC in servlet child context)\n<http><cors/></http>\n// after\n<context:annotation-config/>\n<mvc:annotation-driven/> <!-- in the SAME context as the security config -->\n<http><cors/></http>","handlingStrategy":"validation","validationCode":"String[] names = ctx.getBeanNamesForType(org.springframework.web.servlet.handler.HandlerMappingIntrospector.class);\nif (names.length == 0 && !elt.hasAttribute(\"source\")) throw new IllegalStateException(\"<cors> requires Spring MVC in the shared context or an explicit source\");","typeGuard":null,"tryCatchPattern":"try {\n    ctx.refresh();\n} catch (NoSuchBeanDefinitionException e) {\n    if (e.getBeanName().equals(\"mvcHandlerMappingIntrospector\")) {\n        logger.error(\"Add @EnableWebMvc / <mvc:annotation-driven/> to the security context, or set <cors source=...>\");\n    }\n}","preventionTips":["Co-locate security and MVC configuration in one ApplicationContext","Explicitly reference a CorsConfigurationSource bean instead of relying on MVC introspection","Confirm PreFlightRequestHandler availability before enabling <cors> in non-MVC apps"],"tags":["spring-security","cors","spring-mvc","missing-bean"],"backgroundTag":"missing-dependency","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}