{"record":{"id":"4bdffadecf1a16ba","repo":"spring-projects/spring-security","slug":"could-not-create-corsfilter","errorCode":null,"errorMessage":"Could not create CorsFilter","messagePattern":"Could not create CorsFilter","errorType":"exception","errorClass":"BeanCreationException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/CorsBeanDefinitionParser.java","lineNumber":56,"sourceCode":"\tprivate static final String ATT_SOURCE = \"configuration-source-ref\";\n\n\tprivate static final String ATT_REF = \"ref\";\n\n\tpublic BeanMetadataElement parse(Element element, ParserContext parserContext) {\n\t\tif (element == null) {\n\t\t\treturn null;\n\t\t}\n\t\tString filterRef = element.getAttribute(ATT_REF);\n\t\tif (StringUtils.hasText(filterRef)) {\n\t\t\treturn new RuntimeBeanReference(filterRef);\n\t\t}\n\t\tString configurationSourceRef = element.getAttribute(ATT_SOURCE);\n\t\tif (!StringUtils.hasText(configurationSourceRef)) {\n\t\t\treturn new RootBeanDefinition(CorsFilterFactoryBean.class);\n\t\t}\n\t\tBeanMetadataElement configurationSource = getSource(element, parserContext);\n\t\tif (configurationSource == null) {\n\t\t\tthrow new BeanCreationException(\"Could not create CorsFilter\");\n\t\t}\n\t\tBeanDefinitionBuilder filterBldr = BeanDefinitionBuilder.rootBeanDefinition(CorsFilter.class);\n\t\tfilterBldr.addConstructorArgValue(configurationSource);\n\t\treturn filterBldr.getBeanDefinition();\n\t}\n\n\tpublic BeanMetadataElement getSource(Element element, ParserContext parserContext) {\n\t\tString configurationSourceRef = element.getAttribute(ATT_SOURCE);\n\t\tif (StringUtils.hasText(configurationSourceRef)) {\n\t\t\treturn new RuntimeBeanReference(configurationSourceRef);\n\t\t}\n\t\treturn new RootBeanDefinition(CorsConfigurationSourceFactoryBean.class);\n\t}\n\n}\n","sourceCodeStart":38,"sourceCodeEnd":72,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/CorsBeanDefinitionParser.java#L38-L72","documentation":"CorsBeanDefinitionParser.parse builds the CorsFilter bean for the <cors> element. When no explicit 'source' attribute ref is given, it resolves the CorsConfigurationSource from the context (e.g. HandlerMappingIntrospector). If getSource returns null — meaning no suitable CorsConfigurationSource bean or MVC integration can be located — parsing fails with this BeanCreationException.","triggerScenarios":"<http><cors/></http> is declared without a source attribute, and the surrounding ApplicationContext exposes no bean the parser can use as a CorsConfigurationSource (no mvcHandlerMappingIntrospector and no CorsConfigurationSource bean found by getSource).","commonSituations":"Using Spring Security's <cors> in an application without Spring MVC on the classpath or in the same context; a servlet-only/spring-web-only app; child/parent context split where MVC beans live in a different context than the security config.","solutions":["Define a CorsConfigurationSource bean, e.g. UrlBasedCorsConfigurationSource populated with CorsConfiguration entries","Add a source attribute pointing at it: <cors source=\"corsConfigurationSource\"/>","Ensure Spring MVC is present and configured in the same ApplicationContext so mvcHandlerMappingIntrospector exists","If CORS is not needed, remove the <cors> element"],"exampleFix":"// before\n<http>\n    <cors/>\n</http>\n// after\n<bean id=\"corsConfigurationSource\" class=\"org.springframework.web.cors.UrlBasedCorsConfigurationSource\">\n    <property name=\"corsConfigurations\">\n        <map><entry key=\"/\" value-ref=\"corsConfiguration\"/></map>\n    </property>\n</bean>\n<http>\n    <cors source=\"corsConfigurationSource\"/>\n</http>","handlingStrategy":"validation","validationCode":"boolean hasSource = elt.hasAttribute(\"source\");\nboolean hasMvc = ctx.containsBean(\"mvcHandlerMappingIntrospector\")\n        || ctx.getBeanNamesForType(org.springframework.web.cors.CorsConfigurationSource.class).length > 0;\nif (!hasSource && !hasMvc) throw new IllegalStateException(\"<cors> needs a source ref or a CorsConfigurationSource/MVC in context\");","typeGuard":null,"tryCatchPattern":"try {\n    ctx = new ClassPathXmlApplicationContext(\"security.xml\");\n} catch (BeanCreationException e) {\n    if (\"Could not create CorsFilter\".equals(e.getMessage())) {\n        logger.error(\"Define a CorsConfigurationSource bean or add Spring MVC to this context\");\n    }\n}","preventionTips":["Always define a CorsConfigurationSource bean when using <cors>","Reference it explicitly via the source attribute to avoid implicit resolution","Keep Spring MVC in the same ApplicationContext as security config"],"tags":["spring-security","cors","bean-definition","missing-bean"],"backgroundTag":"missing-dependency","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}