spring-projects/spring-security · error · NoSuchBeanDefinitionException

A Bean named mvcHandlerMappingIntrospector of type org.sprin

Error message

A Bean named mvcHandlerMappingIntrospector of type org.springframework.web.cors.CorsConfigurationSource is required to use <cors>. Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext.

What it means

CorsFilterFactoryBean.getObject locates MVC's PreFlightRequestHandler (via the HandlerMappingIntrospector bean name mvcHandlerMappingIntrospector) to build the pre-flight CorsFilter. When no PreFlightRequestHandler bean exists in the context, it throws NoSuchBeanDefinitionException stating that the mvcHandlerMappingIntrospector-typed CorsConfigurationSource bean is required to use <cors>.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/CorsFilterFactoryBean.java:50

class CorsFilterFactoryBean implements FactoryBean<Filter>, ApplicationContextAware {

	private static final String HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector";

	private ApplicationContext context;

	@Override
	public Filter getObject() {
		if (this.context.containsBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {
			CorsConfigurationSource source = this.context.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,
					CorsConfigurationSource.class);
			return new CorsFilter(source);
		}
		String[] preFlightRequestHandlerNames = this.context.getBeanNamesForType(PreFlightRequestHandler.class);
		if (preFlightRequestHandlerNames.length == 1) {
			PreFlightRequestHandler handler = this.context.getBean(PreFlightRequestHandler.class);
			return new PreFlightRequestFilter(handler);
		}
		throw new NoSuchBeanDefinitionException(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,
				"A Bean named " + HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME + " of type "
						+ CorsConfigurationSource.class.getName()
						+ " is required to use <cors>. Please ensure Spring Security & Spring "
						+ "MVC are configured in a shared ApplicationContext.");
	}

	@Nullable
	@Override
	public Class<?> getObjectType() {
		return Filter.class;
	}

	@Override
	public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
		this.context = applicationContext;
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Enable Spring MVC in the shared context with <mvc:annotation-driven/> or @EnableWebMvc so the HandlerMappingIntrospector and its PreFlightRequestHandler are registered
2. Co-locate security and MVC configuration in one ApplicationContext
3. Provide an explicit CorsConfigurationSource and reference it via <cors source="..."/> to bypass MVC introspection

Example fix

// before (security config in root context, MVC in servlet child context)
<http><cors/></http>
// after
<context:annotation-config/>
<mvc:annotation-driven/> <!-- in the SAME context as the security config -->
<http><cors/></http>

String[] names = ctx.getBeanNamesForType(org.springframework.web.servlet.handler.HandlerMappingIntrospector.class);
if (names.length == 0 && !elt.hasAttribute("source")) throw new IllegalStateException("<cors> requires Spring MVC in the shared context or an explicit source");

try {
    ctx.refresh();
} catch (NoSuchBeanDefinitionException e) {
    if (e.getBeanName().equals("mvcHandlerMappingIntrospector")) {
        logger.error("Add @EnableWebMvc / <mvc:annotation-driven/> to the security context, or set <cors source=...>");
    }
}

When it happens

Trigger: getObject() is invoked (during FilterChainProxy creation for <cors/> without a source attribute) and getBeanNamesForType(PreFlightRequestHandler.class) returns zero entries because Spring MVC's HandlerMappingIntrospector is absent from the shared ApplicationContext.

Common situations: No Spring MVC in the classpath or context; MVC configured in a different (child/parent) ApplicationContext than the security namespace config; forgetting @EnableWebMvc or <mvc:annotation-driven/>; non-Spring-MVC stack using <cors>.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• A Bean named mvcHandlerMappingIntrospector of type org.sprin
• Failed to find a bean that implements `CorsConfigurationSour
• Could not create CorsFilter
• No RSocketSecurity defined
• Cannot configure both a CorsConfigurationSource and a PreFli

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/323ac9c22916dea0. Report an issue: GitHub.