{"record":{"id":"e4df8efc5bb7a360","repo":"spring-projects/spring-security","slug":"cannot-convert-createsession-to-org-springframew","errorCode":null,"errorMessage":"Cannot convert {createSession} to org.springframework.security.config.http.SessionCreationPolicy","messagePattern":"Cannot convert (.+?) to org\\.springframework\\.security\\.config\\.http\\.SessionCreationPolicy","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java","lineNumber":289,"sourceCode":"\t\t\t\tpc.getReaderContext().error(message, pc.extractSource(element));\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate SessionCreationPolicy createPolicy(String createSession) {\n\t\tif (\"ifRequired\".equals(createSession)) {\n\t\t\treturn SessionCreationPolicy.IF_REQUIRED;\n\t\t}\n\t\tif (\"always\".equals(createSession)) {\n\t\t\treturn SessionCreationPolicy.ALWAYS;\n\t\t}\n\t\tif (\"never\".equals(createSession)) {\n\t\t\treturn SessionCreationPolicy.NEVER;\n\t\t}\n\t\tif (\"stateless\".equals(createSession)) {\n\t\t\treturn SessionCreationPolicy.STATELESS;\n\t\t}\n\t\tthrow new IllegalStateException(\n\t\t\t\t\"Cannot convert \" + createSession + \" to \" + SessionCreationPolicy.class.getName());\n\t}\n\n\t@SuppressWarnings(\"rawtypes\")\n\tvoid setLogoutHandlers(ManagedList logoutHandlers) {\n\t\tif (logoutHandlers != null) {\n\t\t\tif (this.concurrentSessionFilter != null) {\n\t\t\t\tthis.concurrentSessionFilter.getPropertyValues().add(\"logoutHandlers\", logoutHandlers);\n\t\t\t}\n\t\t\tif (this.servApiFilter != null) {\n\t\t\t\tthis.servApiFilter.getPropertyValues().add(\"logoutHandlers\", logoutHandlers);\n\t\t\t}\n\t\t}\n\t}\n\n\tvoid setEntryPoint(BeanMetadataElement entryPoint) {\n\t\tif (this.servApiFilter != null) {\n\t\t\tthis.servApiFilter.getPropertyValues().add(\"authenticationEntryPoint\", entryPoint);","sourceCodeStart":271,"sourceCodeEnd":307,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java#L271-L307","documentation":"HttpConfigurationBuilder.createPolicy converts the http element's create-session attribute into a SessionCreationPolicy enum. Only 'ifRequired', 'always', 'never', and 'stateless' are accepted; any other string falls through the equality chain and throws an IllegalStateException including the invalid value and the fully qualified enum class name.","triggerScenarios":"<http create-session=\"...\"> set to a value outside {ifRequired, always, never, stateless} — e.g. 'if_required', 'IF_REQUIRED' (case-sensitive), 'none', or an empty/placeholder value — reaches createPolicy during HttpConfigurationBuilder construction.","commonSituations":"Typos or wrong casing like create-session=\"Never\"; carrying over values from other frameworks (e.g. 'none' from Spring Session docs); IDE auto-complete or hand-edited XML introducing an unsupported token.","solutions":["Set create-session to exactly one of: ifRequired, always, never, stateless (lowercase, camelCase for ifRequired)","Fix casing/typos in the attribute value (e.g. 'Never' -> 'never', 'if_required' -> 'ifRequired')","Remove the create-session attribute if the default (ifRequired) behavior is acceptable"],"exampleFix":"// before\n<http create-session=\"IF_REQUIRED\">\n// after\n<http create-session=\"ifRequired\">","handlingStrategy":"validation","validationCode":"String v = elt.getAttribute(\"create-session\");\nif (!v.isEmpty() && !java.util.Set.of(\"ifRequired\",\"always\",\"never\",\"stateless\").contains(v)) throw new IllegalArgumentException(\"create-session must be ifRequired|always|never|stateless, got: \" + v);","typeGuard":null,"tryCatchPattern":"try {\n    ctx = new ClassPathXmlApplicationContext(\"security.xml\");\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"SessionCreationPolicy\")) {\n        logger.error(\"Fix create-session attribute: {}\", e.getMessage());\n    }\n}","preventionTips":["Use only the four documented create-session values","Remember the value is case-sensitive (ifRequired camelCase)","Rely on XSD validation in your editor/CI to catch invalid attribute values"],"tags":["spring-security","session-management","xml-config","invalid-attribute"],"backgroundTag":"invalid-enum-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}