{"record":{"id":"d07d4e7b44241cd8","repo":"spring-projects/spring-security","slug":"you-cannot-use-bearer-token-ref-and-authentication","errorCode":null,"errorMessage":"You cannot use bearer-token-ref and authentication-converter-ref in the same oauth2-resource-server element","messagePattern":"You cannot use bearer-token-ref and authentication-converter-ref in the same oauth2-resource-server element","errorType":"exception","errorClass":"BeanDefinitionStoreException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/OAuth2ResourceServerBeanDefinitionParser.java","lineNumber":133,"sourceCode":"\tpublic BeanDefinition parse(Element oauth2ResourceServer, ParserContext pc) {\n\t\tElement jwt = DomUtils.getChildElementByTagName(oauth2ResourceServer, Elements.JWT);\n\t\tElement opaqueToken = DomUtils.getChildElementByTagName(oauth2ResourceServer, Elements.OPAQUE_TOKEN);\n\t\tvalidateConfiguration(oauth2ResourceServer, jwt, opaqueToken, pc);\n\t\tif (jwt != null) {\n\t\t\tBeanDefinition jwtAuthenticationProvider = new JwtBeanDefinitionParser().parse(jwt, pc);\n\t\t\tthis.authenticationProviders.add(new RuntimeBeanReference(\n\t\t\t\t\tpc.getReaderContext().registerWithGeneratedName(jwtAuthenticationProvider)));\n\t\t}\n\t\tif (opaqueToken != null) {\n\t\t\tBeanDefinition opaqueTokenAuthenticationProvider = new OpaqueTokenBeanDefinitionParser().parse(opaqueToken,\n\t\t\t\t\tpc);\n\t\t\tthis.authenticationProviders.add(new RuntimeBeanReference(\n\t\t\t\t\tpc.getReaderContext().registerWithGeneratedName(opaqueTokenAuthenticationProvider)));\n\t\t}\n\t\tBeanMetadataElement bearerTokenResolver = getBearerTokenResolver(oauth2ResourceServer);\n\t\tBeanMetadataElement authenticationConverter = getAuthenticationConverter(oauth2ResourceServer);\n\t\tif (bearerTokenResolver != null && authenticationConverter != null) {\n\t\t\tthrow new BeanDefinitionStoreException(\n\t\t\t\t\t\"You cannot use bearer-token-ref and authentication-converter-ref in the same oauth2-resource-server element\");\n\t\t}\n\t\tif (bearerTokenResolver == null && authenticationConverter == null) {\n\t\t\tauthenticationConverter = new RootBeanDefinition(BearerTokenAuthenticationConverter.class);\n\t\t}\n\t\tBeanMetadataElement authenticationEntryPoint = getEntryPoint(oauth2ResourceServer);\n\t\tBeanDefinition requestMatcher = buildRequestMatcher(bearerTokenResolver, authenticationConverter);\n\t\tthis.entryPoints.put(requestMatcher, authenticationEntryPoint);\n\t\tthis.deniedHandlers.put(requestMatcher, this.accessDeniedHandler);\n\t\tthis.ignoreCsrfRequestMatchers.add(requestMatcher);\n\t\tBeanDefinitionBuilder filterBuilder = BeanDefinitionBuilder\n\t\t\t.rootBeanDefinition(BearerTokenAuthenticationFilter.class);\n\t\tBeanMetadataElement authenticationManagerResolver = getAuthenticationManagerResolver(oauth2ResourceServer);\n\t\tfilterBuilder.addConstructorArgValue(authenticationManagerResolver);\n\t\tfilterBuilder.addPropertyValue(AUTHENTICATION_ENTRY_POINT, authenticationEntryPoint);\n\t\tfilterBuilder.addPropertyValue(\"securityContextHolderStrategy\",\n\t\t\t\tthis.authenticationFilterSecurityContextHolderStrategy);\n","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/OAuth2ResourceServerBeanDefinitionParser.java#L115-L151","documentation":"The <oauth2-resource-server> XML element supports configuring bearer token resolution either via bearer-token-ref or converting the request via authentication-converter-ref — but not both simultaneously. parse() (OAuth2ResourceServerBeanDefinitionParser.java:133) throws BeanDefinitionStoreException when both attributes are present, because combining them would create ambiguous authentication handling.","triggerScenarios":"Defining <oauth2-resource-server bearer-token-ref=\"...\" authentication-converter-ref=\"...\"/> in the XML namespace; both getBearerTokenResolver and getAuthenticationConverter return non-null from the same element.","commonSituations":"Copy-pasting attributes from two config examples; migrating from a bearer-token setup to an authentication-converter setup while leaving the old attribute in place.","solutions":["Remove bearer-token-ref and keep only authentication-converter-ref.","Alternatively remove authentication-converter-ref and keep only bearer-token-ref.","If both behaviors are needed, implement a custom authentication converter that internally uses the desired BearerTokenResolver."],"exampleFix":"// before\n<oauth2-resource-server bearer-token-ref=\"myResolver\" authentication-converter-ref=\"myConverter\"/>\n// after\n<oauth2-resource-server authentication-converter-ref=\"myConverter\"/>","handlingStrategy":"validation","validationCode":"Element el = /* oauth2-resource-server element */;\nif (el.hasAttribute(\"bearer-token-ref\") && el.hasAttribute(\"authentication-converter-ref\")) {\n  throw new IllegalArgumentException(\"bearer-token-ref and authentication-converter-ref are mutually exclusive\");\n}","typeGuard":null,"tryCatchPattern":"try { new OAuth2ResourceServerBeanDefinitionParser().parse(el, pc); } catch (BeanDefinitionStoreException e) { if (e.getMessage().contains(\"bearer-token-ref\")) { log.error(\"Remove one of bearer-token-ref / authentication-converter-ref\", e); } throw e; }","preventionTips":["Set at most one of bearer-token-ref / authentication-converter-ref per <oauth2-resource-server>","When migrating to authentication-converter-ref, delete the old bearer-token-ref attribute","Document in your security config which token-handling mechanism is in use"],"tags":["spring-security","oauth2-resource-server","xml-configuration","conflicting-options"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}