{"record":{"id":"98b4c8a5dbd24bfe","repo":"spring-projects/spring-security","slug":"failed-to-find-a-bean-that-implements-corsconfigu","errorCode":null,"errorMessage":"Failed to find a bean that implements `CorsConfigurationSource`. Please ensure that you are using `@EnableWebMvc`, are publishing a `WebMvcConfigurer`, or are publishing a `CorsConfigurationSource` bean.","messagePattern":"Failed to find a bean that implements `CorsConfigurationSource`\\. Please ensure that you are using `@EnableWebMvc`, are publishing a `WebMvcConfigurer`, or are publishing a `CorsConfigurationSource` bean\\.","errorType":"exception","errorClass":"NoSuchBeanDefinitionException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/configurers/CorsConfigurer.java","lineNumber":95,"sourceCode":"\tpublic void configure(H http) {\n\t\tApplicationContext context = http.getSharedObject(ApplicationContext.class);\n\n\t\tif (this.configurationSource != null && this.preFlightRequestHandler != null) {\n\t\t\tthrow new IllegalStateException(\n\t\t\t\t\t\"Cannot configure both a CorsConfigurationSource and a PreFlightRequestHandler on CorsConfigurer\");\n\t\t}\n\n\t\tCorsFilter corsFilter = getCorsFilter(context);\n\t\tif (corsFilter != null) {\n\t\t\thttp.addFilter(corsFilter);\n\t\t\treturn;\n\t\t}\n\t\tPreFlightRequestHandler preFlightRequestHandlerBean = getPreFlightRequestHandler(context);\n\t\tif (preFlightRequestHandlerBean != null) {\n\t\t\thttp.addFilterBefore(new PreFlightRequestFilter(preFlightRequestHandlerBean), CorsFilter.class);\n\t\t\treturn;\n\t\t}\n\t\tthrow new NoSuchBeanDefinitionException(CorsConfigurationSource.class,\n\t\t\t\t\"Failed to find a bean that implements `CorsConfigurationSource`. Please ensure that you are using \"\n\t\t\t\t\t\t+ \"`@EnableWebMvc`, are publishing a `WebMvcConfigurer`, or are publishing a `CorsConfigurationSource` bean.\");\n\t}\n\n\tprivate PreFlightRequestHandler getPreFlightRequestHandler(ApplicationContext context) {\n\t\tif (this.configurationSource != null) {\n\t\t\treturn null;\n\t\t}\n\t\tif (this.preFlightRequestHandler != null) {\n\t\t\treturn this.preFlightRequestHandler;\n\t\t}\n\t\tif (context == null) {\n\t\t\treturn null;\n\t\t}\n\t\tif (context.getBeanNamesForType(PreFlightRequestHandler.class).length > 0) {\n\t\t\treturn context.getBean(PreFlightRequestHandler.class);\n\t\t}\n\t\treturn null;","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/configurers/CorsConfigurer.java#L77-L113","documentation":"When http.cors() is enabled and neither a CorsConfigurationSource nor a PreFlightRequestHandler is explicitly configured, Spring Security searches the ApplicationContext for a CorsConfigurationSource bean (WebMvc also contributes one via @EnableWebMvc/WebMvcConfigurer). If none is found, configure() throws NoSuchBeanDefinitionException because the CorsFilter cannot function without a configuration source.","triggerScenarios":"Calling http.cors() (or .cors(withDefaults())) with no CorsConfigurationSource bean published, no @EnableWebMvc, and no WebMvcConfigurer exposing CORS mappings — typically in a plain Spring Boot or non-MVC app.","commonSituations":"Upgrading Spring Security where defaults tightened; using WebFlux or non-web app while using servlet HttpSecurity; defining CORS via @CrossOrigin only (which does not create a CorsConfigurationSource bean); Spring Boot devtools-free minimal config.","solutions":["Publish a CorsConfigurationSource bean (e.g. UrlBasedCorsConfigurationSource with CorsConfiguration per path)","Add @EnableWebMvc or register a WebMvcConfigurer with addCorsMappings to let the framework provide one","If Spring Boot manages MVC, spring.webflux/WebMvc auto-configuration with CorsRegistry registrations usually suffices; verify a CorsConfigurationSource bean exists via ApplicationContext","If you only need pre-flight handling, provide a PreFlightRequestHandler bean instead"],"exampleFix":"// before\nhttp.cors(withDefaults()); // no source anywhere\n// after\n@Bean\nCorsConfigurationSource corsConfigurationSource() {\n    CorsConfiguration c = new CorsConfiguration();\n    c.setAllowedOrigins(List.of(\"https://app.example.com\"));\n    c.setAllowedMethods(List.of(\"GET\", \"POST\"));\n    UrlBasedCorsConfigurationSource s = new UrlBasedCorsConfigurationSource();\n    s.registerCorsConfiguration(\"/**\", c);\n    return s;\n}","handlingStrategy":"validation","validationCode":"// before app startup\nboolean hasSource = applicationContext.getBeanProvider(CorsConfigurationSource.class)\n        .getIfAvailable() != null;\nboolean mvcCors = applicationContext.getBeanProvider(WebMvcConfigurer.class)\n        .getObjects(WebMvcConfigurer.class).stream().anyMatch(w -> w instanceof CorsConfigurationSource);\nif (!hasSource && !hasCorsViaWebMvc()) throw new IllegalStateException(\"Enable cors: publish a CorsConfigurationSource bean or use @EnableWebMvc\");","typeGuard":"boolean corsSourceAvailable(ApplicationContext ctx) {\n    return ctx.getBeanProvider(CorsConfigurationSource.class).getIfAvailable() != null;\n}","tryCatchPattern":"try {\n    http.cors(withDefaults());\n} catch (NoSuchBeanDefinitionException e) {\n    // publish a CorsConfigurationSource bean or add @EnableWebMvc, then restart\n}","preventionTips":["Always define a CorsConfigurationSource bean when using http.cors() outside Spring Boot MVC auto-config","Remember @CrossOrigin does not create a CorsConfigurationSource bean","Use @EnableWebMvc or a WebMvcConfigurer with addCorsMappings as the standard provider"],"tags":["spring-security","cors","missing-bean","configuration"],"backgroundTag":"missing-required-config","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}