{"record":{"id":"c72f16cb52162d52","repo":"spring-projects/spring-security","slug":"this-object-has-not-been-built","errorCode":null,"errorMessage":"This object has not been built","messagePattern":"This object has not been built","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/AbstractSecurityBuilder.java","lineNumber":51,"sourceCode":"\tprivate O object;\n\n\t@Override\n\tpublic final O build() {\n\t\tif (this.building.compareAndSet(false, true)) {\n\t\t\tthis.object = doBuild();\n\t\t\treturn this.object;\n\t\t}\n\t\tthrow new AlreadyBuiltException(\"This object has already been built\");\n\t}\n\n\t/**\n\t * Gets the object that was built. If it has not been built yet an Exception is\n\t * thrown.\n\t * @return the Object that was built\n\t */\n\tpublic final O getObject() {\n\t\tif (!this.building.get()) {\n\t\t\tthrow new IllegalStateException(\"This object has not been built\");\n\t\t}\n\t\treturn this.object;\n\t}\n\n\t/**\n\t * Subclasses should implement this to perform the build.\n\t * @return the object that should be returned by {@link SecurityBuilder#build()}.\n\t * @throws Exception if an error occurs\n\t */\n\tprotected abstract O doBuild();\n\n}\n","sourceCodeStart":33,"sourceCodeEnd":64,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/AbstractSecurityBuilder.java#L33-L64","documentation":"AbstractSecurityBuilder.getObject() throws IllegalStateException('This object has not been built') when queried before build() has run, because the 'building' flag is still false and this.object is unset. getObject() only returns the product of a completed build.","triggerScenarios":"Calling getObject() before build(), e.g. reading the built AuthenticationManager/SecurityFilterChain from a builder field during bean construction before the security configuration has been applied.","commonSituations":"Injecting the builder and calling getObject() in a @Bean method that runs earlier than the security configuration; accessing the object in a constructor of a bean initialized before security setup; forgetting to call build() entirely in custom builder code.","solutions":["Call build() before getObject(), or prefer getObject() only after the build phase has completed.","Obtain the built object directly as a @Bean (e.g. declare AuthenticationManager as a bean) instead of pulling it from a builder.","Restructure initialization order with @DependsOn or make the consumer lazily fetch the object at first use.","If you control the builder subclass, ensure doBuild() is invoked before exposing getObject()."],"exampleFix":"// before\nAuthenticationManager am = builder.getObject(); // may not be built yet\n// after\nAuthenticationManager am = builder.build(); // ensures built before retrieval","handlingStrategy":"type-guard","validationCode":"if (builder instanceof AbstractSecurityBuilder<?> b && !isBuilt(b)) {\n    b.build(); // build before getObject\n}","typeGuard":null,"tryCatchPattern":"try {\n    object = builder.getObject();\n} catch (IllegalStateException e) {\n    object = builder.build(); // lazily build on first access\n}","preventionTips":["Establish a clear build-before-use order in initialization","Expose built objects as beans rather than via builder.getObject()","Use @DependsOn to enforce security config runs first","Never call getObject() from constructors of earlier-initialized beans"],"tags":["builder","illegal-state","lifecycle","spring-security"],"backgroundTag":"invalid-state-transition","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}