spring-projects/spring-security · error · NoSuchBeanDefinitionException

A Bean named mvcHandlerMappingIntrospector of type org.sprin

Error message

A Bean named mvcHandlerMappingIntrospector of type org.springframework.web.cors.CorsConfigurationSource is required to use <cors>. Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext.

What it means

CorsConfigurationSourceFactoryBean exposes Spring MVC's HandlerMappingIntrospector (bean name mvcHandlerMappingIntrospector) as a CorsConfigurationSource, since recent Spring Framework versions implement CorsConfigurationSource on it. If the shared ApplicationContext contains no bean with that name, getObject throws NoSuchBeanDefinitionException with this message.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/CorsConfigurationSourceFactoryBean.java:43

import org.springframework.web.cors.CorsConfigurationSource;

/**
 * Used for creating an instance of {@link CorsConfigurationSource} and autowiring the
 * {@link ApplicationContext}.
 *
 * @author Rob Winch
 * @since 4.1.1
 */
class CorsConfigurationSourceFactoryBean implements FactoryBean<CorsConfigurationSource>, ApplicationContextAware {

	private static final String HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector";

	private ApplicationContext context;

	@Override
	public CorsConfigurationSource getObject() {
		if (!this.context.containsBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {
			throw new NoSuchBeanDefinitionException(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,
					"A Bean named " + HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME + " of type "
							+ CorsConfigurationSource.class.getName()
							+ " is required to use <cors>. Please ensure Spring Security & Spring "
							+ "MVC are configured in a shared ApplicationContext.");
		}
		return this.context.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME, CorsConfigurationSource.class);
	}

	@Nullable
	@Override
	public Class<?> getObjectType() {
		return CorsConfigurationSource.class;
	}

	@Override
	public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
		this.context = applicationContext;
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Configure Spring MVC in the same ApplicationContext (<mvc:annotation-driven/> or @EnableWebMvc) so mvcHandlerMappingIntrospector is registered
2. Move the security configuration into the same context as Spring MVC (or consolidate to a single-context setup with Spring Boot)
3. Define your own CorsConfigurationSource bean and reference it: <cors source="corsConfigurationSource"/>

Example fix

// before
<beans security> <!-- parent context, no MVC -->
    <http><cors/></http>
</beans>
// after
<http>
    <cors source="corsConfigurationSource"/>
</http>
<bean id="corsConfigurationSource" class="org.springframework.web.cors.UrlBasedCorsConfigurationSource">...</bean>

if (!applicationContext.containsBean("mvcHandlerMappingIntrospector")) {
    throw new IllegalStateException("<cors> without source requires mvcHandlerMappingIntrospector; configure Spring MVC in this context");
}

try {
    ctx.refresh();
} catch (NoSuchBeanDefinitionException e) {
    if (e.getBeanName().equals("mvcHandlerMappingIntrospector")) {
        logger.error("Enable Spring MVC (<mvc:annotation-driven/> / @EnableWebMvc) or pass a source to <cors>");
    }
}

When it happens

Trigger: <cors/> is used without a source attribute and the FactoryBean's getObject() runs when context.containsBean("mvcHandlerMappingIntrospector") is false — i.e. Spring MVC's annotation-driven processing did not register the introspector in this ApplicationContext.

Common situations: Security XML loaded in a parent context (root web context) while MVC lives in the dispatcher-servlet child context; MVC not configured at all (no <mvc:annotation-driven/> or @EnableWebMvc); non-MVC web application using <cors>.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• A Bean named mvcHandlerMappingIntrospector of type org.sprin
• Failed to find a bean that implements `CorsConfigurationSour
• Could not create CorsFilter
• No RSocketSecurity defined
• Cannot configure both a CorsConfigurationSource and a PreFli

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/7ea8449072752312. Report an issue: GitHub.