{"record":{"id":"a9be59a83112d6e3","repo":"spring-projects/spring-security","slug":"a-serveronetimetokengenerationsuccesshandler-is-re","errorCode":null,"errorMessage":"A ServerOneTimeTokenGenerationSuccessHandler is required to enable oneTimeTokenLogin(). Please provide it as a bean or pass it to the oneTimeTokenLogin() DSL.","messagePattern":"A ServerOneTimeTokenGenerationSuccessHandler is required to enable oneTimeTokenLogin\\(\\)\\. Please provide it as a bean or pass it to the oneTimeTokenLogin\\(\\) DSL\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java","lineNumber":5259,"sourceCode":"\t\t * {@link WebSessionServerSecurityContextRepository}. For the\n\t\t * {@code SecurityContext} to be loaded on subsequent requests the\n\t\t * {@link ReactorContextWebFilter} must be configured to be able to load the value\n\t\t * (they are not implicitly linked).\n\t\t * @param securityContextRepository the repository to use\n\t\t * @return the {@link OneTimeTokenLoginSpec} to continue configuring\n\t\t */\n\t\tpublic OneTimeTokenLoginSpec securityContextRepository(\n\t\t\t\tServerSecurityContextRepository securityContextRepository) {\n\t\t\tthis.securityContextRepository = securityContextRepository;\n\t\t\treturn this;\n\t\t}\n\n\t\tprivate ServerOneTimeTokenGenerationSuccessHandler getTokenGenerationSuccessHandler() {\n\t\t\tif (this.tokenGenerationSuccessHandler == null) {\n\t\t\t\tthis.tokenGenerationSuccessHandler = getBeanOrNull(ServerOneTimeTokenGenerationSuccessHandler.class);\n\t\t\t}\n\t\t\tif (this.tokenGenerationSuccessHandler == null) {\n\t\t\t\tthrow new IllegalStateException(\"\"\"\n\t\t\t\t\t\tA ServerOneTimeTokenGenerationSuccessHandler is required to enable oneTimeTokenLogin().\n\t\t\t\t\t\tPlease provide it as a bean or pass it to the oneTimeTokenLogin() DSL.\n\t\t\t\t\t\t\"\"\");\n\t\t\t}\n\t\t\treturn this.tokenGenerationSuccessHandler;\n\t\t}\n\n\t\t/**\n\t\t * Specifies the URL to send users to if login is required. A default login page\n\t\t * will be generated when this attribute is not specified.\n\t\t * @param loginPage the URL to send users to if login is required\n\t\t * @return the {@link OAuth2LoginSpec} for further configuration\n\t\t * @since 6.5\n\t\t */\n\t\tpublic OneTimeTokenLoginSpec loginPage(String loginPage) {\n\t\t\tAssert.hasText(loginPage, \"loginPage cannot be empty\");\n\t\t\tthis.loginPage = loginPage;\n\t\t\treturn this;","sourceCodeStart":5241,"sourceCodeEnd":5277,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java#L5241-L5277","documentation":"Enabling oneTimeTokenLogin() on reactive ServerHttpSecurity requires a ServerOneTimeTokenGenerationSuccessHandler to deliver the generated token (e.g. by email/link). If none is provided via the DSL or found as a bean, this IllegalStateException is thrown during filter chain setup.","triggerScenarios":"Calling http.oneTimeTokenLogin() in reactive config while neither a ServerOneTimeTokenGenerationSuccessHandler bean exists nor one was passed to the DSL.","commonSituations":"Adopting magic-link/one-time-token login and assuming a default delivery mechanism exists; upgrading Spring Security and enabling ott login without porting the token generation handler.","solutions":["Publish a ServerOneTimeTokenGenerationSuccessHandler bean implementing token delivery","Pass a handler to the DSL: .oneTimeTokenLogin(ott -> ott.tokenGenerationSuccessHandler(handler))","If one-time token login is not intended, remove the oneTimeTokenLogin() call"],"exampleFix":"// before\nhttp.oneTimeTokenLogin();\n\n// after\n@Bean\nServerOneTimeTokenGenerationSuccessHandler tokenHandler() {\n  return (token, request, response) -> { /* deliver token, e.g. via email */ };\n}\nhttp.oneTimeTokenLogin(ott -> ott.tokenGenerationSuccessHandler(tokenHandler()));","handlingStrategy":"validation","validationCode":"if (context.getBeanNamesForType(ServerOneTimeTokenGenerationSuccessHandler.class).length == 0) {\n  throw new IllegalStateException(\"oneTimeTokenLogin() requires a ServerOneTimeTokenGenerationSuccessHandler bean\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Publish the token generation success handler before enabling oneTimeTokenLogin()","Pass the handler explicitly via the DSL instead of bean lookup","Document the required bean next to the security config"],"tags":["reactive","spring-security","one-time-token","missing-bean"],"backgroundTag":"missing-required-config","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}