{"record":{"id":"81bb4de247652c92","repo":"spring-projects/spring-security","slug":"order-on-websecurityconfigurers-must-be-unique-o","errorCode":null,"errorMessage":"@Order on WebSecurityConfigurers must be unique. Order of \" + order + \" was already used on \" + previousConfig + \", so it cannot be used on \" + config + \" too.","messagePattern":"@Order on WebSecurityConfigurers must be unique\\. Order of \" \\+ order \\+ \" was already used on \" \\+ previousConfig \\+ \", so it cannot be used on \" \\+ config \\+ \" too\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java","lineNumber":171,"sourceCode":"\t * @throws Exception\n\t */\n\t@Autowired(required = false)\n\tpublic void setFilterChainProxySecurityConfigurer(ObjectPostProcessor<Object> objectPostProcessor,\n\t\t\tConfigurableListableBeanFactory beanFactory) throws Exception {\n\t\tthis.webSecurity = objectPostProcessor.postProcess(new WebSecurity(objectPostProcessor));\n\t\tif (this.debugEnabled != null) {\n\t\t\tthis.webSecurity.debug(this.debugEnabled);\n\t\t}\n\t\tList<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers = new AutowiredWebSecurityConfigurersIgnoreParents(\n\t\t\t\tbeanFactory)\n\t\t\t.getWebSecurityConfigurers();\n\t\twebSecurityConfigurers.sort(AnnotationAwareOrderComparator.INSTANCE);\n\t\tInteger previousOrder = null;\n\t\tObject previousConfig = null;\n\t\tfor (SecurityConfigurer<Filter, WebSecurity> config : webSecurityConfigurers) {\n\t\t\tInteger order = AnnotationAwareOrderComparator.lookupOrder(config);\n\t\t\tif (previousOrder != null && previousOrder.equals(order)) {\n\t\t\t\tthrow new IllegalStateException(\"@Order on WebSecurityConfigurers must be unique. Order of \" + order\n\t\t\t\t\t\t+ \" was already used on \" + previousConfig + \", so it cannot be used on \" + config + \" too.\");\n\t\t\t}\n\t\t\tpreviousOrder = order;\n\t\t\tpreviousConfig = config;\n\t\t}\n\t\tfor (SecurityConfigurer<Filter, WebSecurity> webSecurityConfigurer : webSecurityConfigurers) {\n\t\t\tthis.webSecurity.apply(webSecurityConfigurer);\n\t\t}\n\t}\n\n\t@Autowired(required = false)\n\tvoid setFilterChains(List<SecurityFilterChain> securityFilterChains) {\n\t\tthis.securityFilterChains = securityFilterChains;\n\t}\n\n\t@Autowired(required = false)\n\tvoid setWebSecurityCustomizers(List<WebSecurityCustomizer> webSecurityCustomizers) {\n\t\tthis.webSecurityCustomizers = webSecurityCustomizers;","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java#L153-L189","documentation":"Error \"@Order on WebSecurityConfigurers must be unique. Order of \" + order + \" was already used on \" + previousConfig + \", so it cannot be used on \" + config + \" too.\" thrown in spring-projects/spring-security.","triggerScenarios":"Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java:171 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add a distinct @Order annotation to each WebSecurityConfigurer so no two share the same order value","If two configurers intentionally share an order, merge them into a single SecurityConfigurer","Use setOrder on the beans (e.g. via @Configuration ordering) to guarantee uniqueness before AutowiredWebSecurityConfigurersIgnoreParents sorts them"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}