spring-projects/spring-security · error · IllegalStateException

AdviceMode '{adviceMode}' is not supported

Error message

AdviceMode '{adviceMode}' is not supported

What it means

MethodSecuritySelector is an ImportSelector that picks the method-security configuration based on the AdviceMode declared on @EnableGlobalMethodSecurity. Only PROXY and ASPECTJ are implemented; any other value throws this IllegalStateException. In practice this only happens with a corrupt/invalid annotation value.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecuritySelector.java:99

	}

	private static final class AutoProxyRegistrarSelector extends AdviceModeImportSelector<EnableMethodSecurity> {

		private static final String[] IMPORTS = new String[] { AutoProxyRegistrar.class.getName(),
				MethodSecurityAdvisorRegistrar.class.getName() };

		private static final String[] ASPECTJ_IMPORTS = new String[] {
				MethodSecurityAspectJAutoProxyRegistrar.class.getName() };

		@Override
		protected String[] selectImports(@NonNull AdviceMode adviceMode) {
			if (adviceMode == AdviceMode.PROXY) {
				return IMPORTS;
			}
			if (adviceMode == AdviceMode.ASPECTJ) {
				return ASPECTJ_IMPORTS;
			}
			throw new IllegalStateException("AdviceMode '" + adviceMode + "' is not supported");
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Set adviceMode = AdviceMode.PROXY (the default) on @EnableGlobalMethodSecurity
2. If you need AspectJ weaving, set adviceMode = AdviceMode.ASPECTJ
3. Remove any custom/invalid AdviceMode value; only the two enum constants are supported

Example fix

// before
@EnableGlobalMethodSecurity(prePostEnabled = true, adviceMode = AdviceMode.ASPECTJ)
// after (if not using AspectJ)
@EnableGlobalMethodSecurity(prePostEnabled = true)

AdviceMode mode = enableGlobalMethodSecurity.adviceMode();
if (mode != AdviceMode.PROXY && mode != AdviceMode.ASPECTJ) {
    throw new IllegalArgumentException("Unsupported adviceMode: " + mode);
}

try {
    ctx.refresh();
} catch (BeanCreationException e) {
    if (e.getMessage() != null && e.getMessage().contains("AdviceMode")) {
        // fall back to default PROXY configuration
    }
    throw e;
}

When it happens

Trigger: Setting adviceMode to a value other than PROXY or ASPECTJ on @EnableGlobalMethodSecurity; custom AdviceMode enums supplied via a patched annotation; programmatic annotation construction with a null or unexpected AdviceMode.

Common situations: Hand-edited or generated annotations with wrong adviceMode; upgrading Spring Security where new AdviceMode values exist but the selector does not support them; copy-paste mistakes in meta-annotations.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• org.springframework.security.config.annotation.method.config
• AdviceMode {adviceMode} is not supported
• Access is denied
• RunAsImplAuthenticationProvider.incorrectKey
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b1a05c5d00be7f36. Report an issue: GitHub.