spring-projects/spring-security · error · IllegalStateException
AdviceMode {adviceMode} is not supported
Error message
AdviceMode {adviceMode} is not supported What it means
ReactiveMethodSecuritySelector selects imports for reactive method security based on the AdviceMode of @EnableReactiveMethodSecurity. Only AdviceMode.PROXY is supported; any other mode (e.g. ASPECTJ) throws this IllegalStateException because reactive method security has no AspectJ implementation.
Source
Thrown at config/src/main/java/org/springframework/security/config/annotation/method/configuration/ReactiveMethodSecuritySelector.java:92
if (isObservabilityPresent) {
imports.add(ReactiveMethodObservationConfiguration.class.getName());
}
imports.add(AuthorizationProxyConfiguration.class.getName());
return imports.toArray(new String[0]);
}
private static final class AutoProxyRegistrarSelector
extends AdviceModeImportSelector<EnableReactiveMethodSecurity> {
private static final String[] IMPORTS = new String[] { AutoProxyRegistrar.class.getName(),
MethodSecurityAdvisorRegistrar.class.getName() };
@Override
protected String[] selectImports(@NonNull AdviceMode adviceMode) {
if (adviceMode == AdviceMode.PROXY) {
return IMPORTS;
}
throw new IllegalStateException("AdviceMode " + adviceMode + " is not supported");
}
}
}
View on GitHub (pinned to 96852e8860)
Solutions
- Remove the adviceMode attribute so the default PROXY is used
- Explicitly set adviceMode = AdviceMode.PROXY on @EnableReactiveMethodSecurity
- If AspectJ-style weaving is required for reactive code, implement it outside Spring Security's method-security support
Example fix
// before @EnableReactiveMethodSecurity(adviceMode = AdviceMode.ASPECTJ) // after @EnableReactiveMethodSecurity
Defensive patterns
Strategy: validation
Validate before calling
AdviceMode mode = enableReactiveMethodSecurity.adviceMode();
if (mode != AdviceMode.PROXY) {
throw new IllegalArgumentException(
"@EnableReactiveMethodSecurity only supports AdviceMode.PROXY, got: " + mode);
} Prevention
- Never set adviceMode = ASPECTJ on @EnableReactiveMethodSecurity; only PROXY exists
- Do not copy adviceMode attributes from servlet-side @EnableGlobalMethodSecurity onto the reactive annotation
- Omit adviceMode entirely and rely on the PROXY default
When it happens
Trigger: Declaring adviceMode = AdviceMode.ASPECTJ (or any non-PROXY value) on @EnableReactiveMethodSecurity.
Common situations: Developers copy the adviceMode attribute from @EnableGlobalMethodSecurity (which supports ASPECTJ) onto the reactive annotation; refactoring shared meta-annotations between servlet and reactive stacks.
Related errors
- AdviceMode '{adviceMode}' is not supported
- This has already been built with the following stacktrace. {
- Could not create a default ServerMaximumSessionsExceededHand
- A ReactiveSessionRegistry is needed for concurrent session m
- A ServerOneTimeTokenGenerationSuccessHandler is required to
AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10).
Data as JSON: /api/errors/1e8f175e4e229751.
Report an issue: GitHub.