{"record":{"id":"d7b1a5b7332b051a","repo":"spring-projects/spring-security","slug":"webattributes-application-context-attribute-value","errorCode":null,"errorMessage":"WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE value must be of type ApplicationContext, found type ","messagePattern":"WebAttributes\\.APPLICATION_CONTEXT_ATTRIBUTE value must be of type ApplicationContext, found type ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java","lineNumber":234,"sourceCode":"\t\tApplicationContext ctx = getApplicationContext();\n\t\tMap<String, WebInvocationPrivilegeEvaluator> wipes = ctx.getBeansOfType(WebInvocationPrivilegeEvaluator.class);\n\t\tif (wipes.isEmpty()) {\n\t\t\tthrow new IOException(\n\t\t\t\t\t\"No visible WebInvocationPrivilegeEvaluator instance could be found in the application \"\n\t\t\t\t\t\t\t+ \"context. There must be at least one in order to support the use of URL access checks in 'authorize' tags.\");\n\t\t}\n\t\treturn (WebInvocationPrivilegeEvaluator) wipes.values().toArray()[0];\n\t}\n\n\tprivate ApplicationContext getApplicationContext() {\n\t\tObject value = getRequest().getAttribute(WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE);\n\t\tif (value == null) {\n\t\t\treturn SecurityWebApplicationContextUtils.findRequiredWebApplicationContext(getServletContext());\n\t\t}\n\t\tif (value instanceof ApplicationContext context) {\n\t\t\treturn context;\n\t\t}\n\t\tthrow new IllegalArgumentException(\"WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE value must be of type \"\n\t\t\t\t+ \"ApplicationContext, found type \" + value.getClass());\n\t}\n\n}\n","sourceCodeStart":216,"sourceCodeEnd":239,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java#L216-L239","documentation":"AbstractAuthorizeTag.getApplicationContext() reads the ApplicationContext from a request attribute (WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE) when rendering security taglibs. If the attribute is present but holds an object that is not an ApplicationContext, the tag cannot resolve the security context and throws IllegalArgumentException. This guards against code that stashes a wrong-typed object under that well-known attribute key.","triggerScenarios":"A custom filter/interceptor or test sets request attribute WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE (value 'org.springframework.web.servlet.DispatcherServlet.CONTEXT' style key) to something other than an ApplicationContext (e.g. a servlet context, a wrapper, or a mock), then a JSP using <sec:authorize> calls getApplicationContext().","commonSituations":"Legacy JSP apps migrating Spring versions where the attribute population code changed; tests manually setting request attributes; custom view helpers reusing the attribute key for their own purposes.","solutions":["Fix the code that sets the APPLICATION_CONTEXT_ATTRIBUTE request attribute so it stores a real org.springframework.context.ApplicationContext","Remove the attribute and let the tag fall back to SecurityWebApplicationContextUtils.findRequiredWebApplicationContext(getServletContext()) by ensuring a root WebApplicationContext is published via ContextLoaderListener","If you only need the servlet context lookup, delete the request.setAttribute(...) line instead of setting a non-ApplicationContext value"],"exampleFix":"// before\nrequest.setAttribute(WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE, servletContext);\n// after\nrequest.setAttribute(WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE,\n    WebApplicationContextUtils.getWebApplicationContext(servletContext));","handlingStrategy":"validation","validationCode":"Object v = request.getAttribute(WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE);\nif (v != null && !(v instanceof ApplicationContext)) {\n    throw new IllegalStateException(\"Attribute holds \" + v.getClass() + \", expected ApplicationContext\");\n}","typeGuard":"boolean isValidContext(Object v) {\n    return v == null || v instanceof ApplicationContext;\n}","tryCatchPattern":"try {\n    ctx = tag.getApplicationContext();\n} catch (IllegalArgumentException e) {\n    log.warn(\"Bad APPLICATION_CONTEXT_ATTRIBUTE: {}\", e.getMessage());\n    ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);\n}","preventionTips":["Never store non-ApplicationContext objects under WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE","Rely on ContextLoaderListener to publish the root context instead of manual attribute setting","Write an integration test rendering the JSP with the tag"],"tags":["spring-security","jsp-taglib","illegal-argument","type-mismatch"],"backgroundTag":"type-mismatch","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}