{"record":{"id":"574cdad7c0c39aa9","repo":"spring-projects/spring-security","slug":"this-has-already-been-built-with-the-following-sta","errorCode":null,"errorMessage":"This has already been built with the following stacktrace. {buildToString}","messagePattern":"This has already been built with the following stacktrace\\. (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java","lineNumber":1079,"sourceCode":"\t * @param oneTimeTokenLoginCustomizer the {@link Customizer} to provide more options\n\t * for the {@link OneTimeTokenLoginSpec}\n\t * @return the {@link ServerHttpSecurity} for further customizations\n\t */\n\tpublic ServerHttpSecurity oneTimeTokenLogin(Customizer<OneTimeTokenLoginSpec> oneTimeTokenLoginCustomizer) {\n\t\tif (this.oneTimeTokenLogin == null) {\n\t\t\tthis.oneTimeTokenLogin = new OneTimeTokenLoginSpec();\n\t\t}\n\t\toneTimeTokenLoginCustomizer.customize(this.oneTimeTokenLogin);\n\t\treturn this;\n\t}\n\n\t/**\n\t * Builds the {@link SecurityWebFilterChain}.\n\t * @return the {@link SecurityWebFilterChain}\n\t */\n\tpublic SecurityWebFilterChain build() {\n\t\tif (this.built != null) {\n\t\t\tthrow new IllegalStateException(\n\t\t\t\t\t\"This has already been built with the following stacktrace. \" + buildToString());\n\t\t}\n\t\tthis.built = new RuntimeException(\"First Build Invocation\").fillInStackTrace();\n\t\tif (this.headers != null) {\n\t\t\tthis.headers.configure(this);\n\t\t}\n\t\tWebFilter securityContextRepositoryWebFilter = securityContextRepositoryWebFilter();\n\t\tthis.webFilters.add(securityContextRepositoryWebFilter);\n\t\tif (this.sessionManagement != null) {\n\t\t\tthis.sessionManagement.configure(this);\n\t\t}\n\t\tif (this.httpsRedirectSpec != null) {\n\t\t\tthis.httpsRedirectSpec.configure(this);\n\t\t}\n\t\tif (this.x509 != null) {\n\t\t\tthis.x509.configure(this);\n\t\t}\n\t\tif (this.csrf != null) {","sourceCodeStart":1061,"sourceCodeEnd":1097,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java#L1061-L1097","documentation":"ServerHttpSecurity.build() constructs the SecurityWebFilterChain and must run once per instance. A second call on the same ServerHttpSecurity instance throws IllegalStateException including the stacktrace of the first build to aid debugging.","triggerScenarios":"Calling build() (or SpringBootWebSecurityConfiguration/application code paths that call it) twice on the same ServerHttpSecurity instance; e.g. invoking build() inside a @Bean method and then again from framework wiring.","commonSituations":"Custom security configuration that both returns http.build() and triggers auto-configuration building the same instance; calling http.build() in a helper called from multiple places; programmatic filter chain creation reused across refreshes.","solutions":["Call build() exactly once per ServerHttpSecurity instance and cache/return the resulting SecurityWebFilterChain","Restructure the configuration so each @Bean method creates its own HttpSecurity instance","If reconfiguration is needed, create a new ServerHttpSecurity rather than rebuilding the old one"],"exampleFix":"// before\n@Bean\nSecurityWebFilterChain chain1(ServerHttpSecurity http) { return http.build(); }\n@Bean\nSecurityWebFilterChain chain2(ServerHttpSecurity http) { return http.build(); } // second build\n\n// after\n@Bean\nSecurityWebFilterChain chain(ServerHttpSecurity http) { return http.build(); }","handlingStrategy":"try-catch","validationCode":"// track build state yourself before calling build() a second time\nif (alreadyBuilt) throw new IllegalStateException(\"ServerHttpSecurity already built\");","typeGuard":null,"tryCatchPattern":"try {\n  return http.build();\n} catch (IllegalStateException e) {\n  if (e.getMessage().startsWith(\"This has already been built\")) {\n    // fix configuration: build() must be called once per ServerHttpSecurity\n  }\n  throw e;\n}","preventionTips":["Call http.build() once, in the same bean method that creates it","Do not share a ServerHttpSecurity instance across beans or lifecycle phases","Store the resulting SecurityWebFilterChain instead of rebuilding"],"tags":["reactive","spring-security","illegal-state","lifecycle"],"backgroundTag":"invalid-state-transition","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}