{"record":{"id":"7ea8449072752312","repo":"spring-projects/spring-security","slug":"a-bean-named-mvchandlermappingintrospector-of-type","errorCode":null,"errorMessage":"A Bean named mvcHandlerMappingIntrospector of type org.springframework.web.cors.CorsConfigurationSource is required to use <cors>. Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext.","messagePattern":"A Bean named mvcHandlerMappingIntrospector of type org\\.springframework\\.web\\.cors\\.CorsConfigurationSource is required to use <cors>\\. Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext\\.","errorType":"exception","errorClass":"NoSuchBeanDefinitionException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/CorsConfigurationSourceFactoryBean.java","lineNumber":43,"sourceCode":"import org.springframework.web.cors.CorsConfigurationSource;\n\n/**\n * Used for creating an instance of {@link CorsConfigurationSource} and autowiring the\n * {@link ApplicationContext}.\n *\n * @author Rob Winch\n * @since 4.1.1\n */\nclass CorsConfigurationSourceFactoryBean implements FactoryBean<CorsConfigurationSource>, ApplicationContextAware {\n\n\tprivate static final String HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = \"mvcHandlerMappingIntrospector\";\n\n\tprivate ApplicationContext context;\n\n\t@Override\n\tpublic CorsConfigurationSource getObject() {\n\t\tif (!this.context.containsBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {\n\t\t\tthrow new NoSuchBeanDefinitionException(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,\n\t\t\t\t\t\"A Bean named \" + HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME + \" of type \"\n\t\t\t\t\t\t\t+ CorsConfigurationSource.class.getName()\n\t\t\t\t\t\t\t+ \" is required to use <cors>. Please ensure Spring Security & Spring \"\n\t\t\t\t\t\t\t+ \"MVC are configured in a shared ApplicationContext.\");\n\t\t}\n\t\treturn this.context.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME, CorsConfigurationSource.class);\n\t}\n\n\t@Nullable\n\t@Override\n\tpublic Class<?> getObjectType() {\n\t\treturn CorsConfigurationSource.class;\n\t}\n\n\t@Override\n\tpublic void setApplicationContext(ApplicationContext applicationContext) throws BeansException {\n\t\tthis.context = applicationContext;\n\t}","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/CorsConfigurationSourceFactoryBean.java#L25-L61","documentation":"CorsConfigurationSourceFactoryBean exposes Spring MVC's HandlerMappingIntrospector (bean name mvcHandlerMappingIntrospector) as a CorsConfigurationSource, since recent Spring Framework versions implement CorsConfigurationSource on it. If the shared ApplicationContext contains no bean with that name, getObject throws NoSuchBeanDefinitionException with this message.","triggerScenarios":"<cors/> is used without a source attribute and the FactoryBean's getObject() runs when context.containsBean(\"mvcHandlerMappingIntrospector\") is false — i.e. Spring MVC's annotation-driven processing did not register the introspector in this ApplicationContext.","commonSituations":"Security XML loaded in a parent context (root web context) while MVC lives in the dispatcher-servlet child context; MVC not configured at all (no <mvc:annotation-driven/> or @EnableWebMvc); non-MVC web application using <cors>.","solutions":["Configure Spring MVC in the same ApplicationContext (<mvc:annotation-driven/> or @EnableWebMvc) so mvcHandlerMappingIntrospector is registered","Move the security configuration into the same context as Spring MVC (or consolidate to a single-context setup with Spring Boot)","Define your own CorsConfigurationSource bean and reference it: <cors source=\"corsConfigurationSource\"/>"],"exampleFix":"// before\n<beans security> <!-- parent context, no MVC -->\n    <http><cors/></http>\n</beans>\n// after\n<http>\n    <cors source=\"corsConfigurationSource\"/>\n</http>\n<bean id=\"corsConfigurationSource\" class=\"org.springframework.web.cors.UrlBasedCorsConfigurationSource\">...</bean>","handlingStrategy":"validation","validationCode":"if (!applicationContext.containsBean(\"mvcHandlerMappingIntrospector\")) {\n    throw new IllegalStateException(\"<cors> without source requires mvcHandlerMappingIntrospector; configure Spring MVC in this context\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    ctx.refresh();\n} catch (NoSuchBeanDefinitionException e) {\n    if (e.getBeanName().equals(\"mvcHandlerMappingIntrospector\")) {\n        logger.error(\"Enable Spring MVC (<mvc:annotation-driven/> / @EnableWebMvc) or pass a source to <cors>\");\n    }\n}","preventionTips":["Register <mvc:annotation-driven/> or @EnableWebMvc wherever <cors> is used","Avoid splitting MVC and security across parent/child contexts","Prefer an explicit source attribute for deterministic wiring"],"tags":["spring-security","cors","spring-mvc","missing-bean"],"backgroundTag":"missing-dependency","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}