{"record":{"id":"f93ee0b2c7b0a088","repo":"spring-projects/spring-security","slug":"unknown-channel-attribute-requiredchannel","errorCode":null,"errorMessage":"Unknown channel attribute {requiredChannel}","messagePattern":"Unknown channel attribute (.+?)","errorType":"exception","errorClass":"BeanCreationException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/ChannelAttributeFactory.java","lineNumber":58,"sourceCode":" */\n@Deprecated\npublic final class ChannelAttributeFactory {\n\n\tprivate static final String OPT_REQUIRES_HTTP = \"http\";\n\n\tprivate static final String OPT_REQUIRES_HTTPS = \"https\";\n\n\tprivate static final String OPT_ANY_CHANNEL = \"any\";\n\n\tprivate ChannelAttributeFactory() {\n\t}\n\n\tpublic static List<ConfigAttribute> createChannelAttributes(String requiredChannel) {\n\t\tString channelConfigAttribute = switch (requiredChannel) {\n\t\t\tcase OPT_REQUIRES_HTTPS -> \"REQUIRES_SECURE_CHANNEL\";\n\t\t\tcase OPT_REQUIRES_HTTP -> \"REQUIRES_INSECURE_CHANNEL\";\n\t\t\tcase OPT_ANY_CHANNEL -> ChannelDecisionManagerImpl.ANY_CHANNEL;\n\t\t\tdefault -> throw new BeanCreationException(\"Unknown channel attribute \" + requiredChannel);\n\t\t};\n\t\treturn SecurityConfig.createList(channelConfigAttribute);\n\t}\n\n}\n","sourceCodeStart":40,"sourceCodeEnd":64,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/ChannelAttributeFactory.java#L40-L64","documentation":"ChannelAttributeFactory.createChannelAttributes maps the http element's requires-channel attribute value ('https', 'http', or 'any') to a channel security ConfigAttribute used by ChannelDecisionManagerImpl. Any other value falls into the switch default and throws a BeanCreationException naming the offending attribute.","triggerScenarios":"A <http> or <intercept-url> configuration sets requires-channel to a value other than 'https', 'http', or 'any' — e.g. a typo like 'https://' or 'HTTPS' (case-sensitive comparison via switch on the constant strings).","commonSituations":"Typing 'requires-channel=\"ssl\"' or 'requires-channel=\"https\" with trailing whitespace'; assuming the attribute accepts a URL or scheme expression; XML generated programmatically with wrong casing.","solutions":["Set requires-channel to exactly one of: https, http, or any (lowercase, no punctuation)","Fix typos or stray whitespace/URL prefixes in the attribute value","Remove the requires-channel attribute entirely if channel security is not needed"],"exampleFix":"// before\n<intercept-url pattern=\"/secure/**\" requires-channel=\"https://\"/>\n// after\n<intercept-url pattern=\"/secure/**\" requires-channel=\"https\"/>","handlingStrategy":"validation","validationCode":"String v = elt.getAttribute(\"requires-channel\");\nif (!v.isEmpty() && !java.util.Set.of(\"https\",\"http\",\"any\").contains(v)) throw new IllegalArgumentException(\"requires-channel must be https|http|any, got: \" + v);","typeGuard":null,"tryCatchPattern":"try {\n    ctx = new ClassPathXmlApplicationContext(\"security.xml\");\n} catch (BeanCreationException e) {\n    if (e.getMessage().startsWith(\"Unknown channel attribute\")) {\n        logger.error(\"Fix requires-channel value: {}\", e.getMessage());\n    }\n}","preventionTips":["Use XML-schema validation so only enumerated values pass","Remember values are case-sensitive lowercase","Never put a URL or scheme with slashes in requires-channel"],"tags":["spring-security","xml-config","invalid-attribute","channel-security"],"backgroundTag":"invalid-enum-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}