What causes "AdviceMode {adviceMode} is not supported" in spring-projects/spring-security?

Remove the adviceMode attribute so the default PROXY is used

spring-projects/spring-security · error · IllegalStateException

AdviceMode is not supported

Error message

AdviceMode {adviceMode} is not supported

What it means

ReactiveMethodSecuritySelector selects imports for reactive method security based on the AdviceMode of @EnableReactiveMethodSecurity. Only AdviceMode.PROXY is supported; any other mode (e.g. ASPECTJ) throws this IllegalStateException because reactive method security has no AspectJ implementation.

Solutions

Remove the adviceMode attribute so the default PROXY is used
Explicitly set adviceMode = AdviceMode.PROXY on @EnableReactiveMethodSecurity
If AspectJ-style weaving is required for reactive code, implement it outside Spring Security's method-security support

Example fix

// before
@EnableReactiveMethodSecurity(adviceMode = AdviceMode.ASPECTJ)
// after
@EnableReactiveMethodSecurity

Defensive patterns

Strategy: validation

Validate before calling

AdviceMode mode = enableReactiveMethodSecurity.adviceMode();
if (mode != AdviceMode.PROXY) {
    throw new IllegalArgumentException(
        "@EnableReactiveMethodSecurity only supports AdviceMode.PROXY, got: " + mode);
}

Prevention

Never set adviceMode = ASPECTJ on @EnableReactiveMethodSecurity; only PROXY exists
Do not copy adviceMode attributes from servlet-side @EnableGlobalMethodSecurity onto the reactive annotation
Omit adviceMode entirely and rely on the PROXY default

When it happens

Trigger: Declaring adviceMode = AdviceMode.ASPECTJ (or any non-PROXY value) on @EnableReactiveMethodSecurity.

Common situations: Developers copy the adviceMode attribute from @EnableGlobalMethodSecurity (which supports ASPECTJ) onto the reactive annotation; refactoring shared meta-annotations between servlet and reactive stacks.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/1e8f175e4e229751. Report an issue: GitHub.

Appendix: source

Thrown at config/src/main/java/org/springframework/security/config/annotation/method/configuration/ReactiveMethodSecuritySelector.java:92

		if (isObservabilityPresent) {
			imports.add(ReactiveMethodObservationConfiguration.class.getName());
		}
		imports.add(AuthorizationProxyConfiguration.class.getName());
		return imports.toArray(new String[0]);
	}

	private static final class AutoProxyRegistrarSelector
			extends AdviceModeImportSelector<EnableReactiveMethodSecurity> {

		private static final String[] IMPORTS = new String[] { AutoProxyRegistrar.class.getName(),
				MethodSecurityAdvisorRegistrar.class.getName() };

		@Override
		protected String[] selectImports(@NonNull AdviceMode adviceMode) {
			if (adviceMode == AdviceMode.PROXY) {
				return IMPORTS;
			}
			throw new IllegalStateException("AdviceMode " + adviceMode + " is not supported");
		}

	}

}

View on GitHub (pinned to 96852e8860)