spring-projects/spring-security · error · IllegalStateException

Cannot configure both a CorsConfigurationSource and a PreFli

Error message

Cannot configure both a CorsConfigurationSource and a PreFlightRequestHandler on CorsConfigurer

What it means

Spring Security's CorsConfigurer only allows one CORS configuration mechanism at a time: an explicit CorsConfigurationSource OR a PreFlightRequestHandler, never both. During HttpSecurity configuration, configure() detects both fields being non-null and aborts with IllegalStateException. This is a configuration-conflict guard, not a runtime failure.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/CorsConfigurer.java:81

	/**
	 * Use the given {@link PreFlightRequestHandler} for CORS preflight requests. When
	 * set, {@link CorsFilter} is not used. Cannot be combined with
	 * {@link #configurationSource(CorsConfigurationSource)}.
	 * @param preFlightRequestHandler the handler to use
	 * @return the {@link CorsConfigurer} for additional configuration
	 */
	public CorsConfigurer<H> preFlightRequestHandler(PreFlightRequestHandler preFlightRequestHandler) {
		this.preFlightRequestHandler = preFlightRequestHandler;
		return this;
	}

	@Override
	public void configure(H http) {
		ApplicationContext context = http.getSharedObject(ApplicationContext.class);

		if (this.configurationSource != null && this.preFlightRequestHandler != null) {
			throw new IllegalStateException(
					"Cannot configure both a CorsConfigurationSource and a PreFlightRequestHandler on CorsConfigurer");
		}

		CorsFilter corsFilter = getCorsFilter(context);
		if (corsFilter != null) {
			http.addFilter(corsFilter);
			return;
		}
		PreFlightRequestHandler preFlightRequestHandlerBean = getPreFlightRequestHandler(context);
		if (preFlightRequestHandlerBean != null) {
			http.addFilterBefore(new PreFlightRequestFilter(preFlightRequestHandlerBean), CorsFilter.class);
			return;
		}
		throw new NoSuchBeanDefinitionException(CorsConfigurationSource.class,
				"Failed to find a bean that implements `CorsConfigurationSource`. Please ensure that you are using "
						+ "`@EnableWebMvc`, are publishing a `WebMvcConfigurer`, or are publishing a `CorsConfigurationSource` bean.");
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Keep only one of .configurationSource() or .preFlightRequestHandler() on the http.cors() chain
2. If you need custom pre-flight behavior, move it into a custom CorsConfigurationSource (which returns the configuration the CorsFilter uses) instead of a separate handler
3. If both beans exist in the context and are being picked up, remove the unused bean or don't set both explicitly via the configurer

Example fix

// before
http.cors(c -> c.configurationSource(source).preFlightRequestHandler(handler));
// after
http.cors(c -> c.configurationSource(source));

// before building HttpSecurity
assert !(corsConfigurerHasConfigurationSource() && corsConfigurerHasPreFlightRequestHandler())
    : "Set only one of configurationSource / preFlightRequestHandler";

boolean isCorsConfigValid(CorsConfigurer<HttpSecurity> c) {
    return !(c.hasConfigurationSource() && c.hasPreFlightRequestHandler());
}

When it happens

Trigger: Calling http.cors() with .configurationSource(source) AND .preFlightRequestHandler(handler) on the same CorsConfigurer instance in one HttpSecurity chain.

Common situations: Copy-pasting two different CORS setups into one config class; merging two branches' security configs; following an old tutorial plus a new Spring Security 6.x pre-flight example in the same builder chain.

Related errors

• Cannot apply {configurer} to already built object
• Failed to find a bean that implements `CorsConfigurationSour
• Headers security is enabled, but no headers will be added. E
• Invalid configuration that explicitly sets requireExplicitAu
• This object has already been built

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/12714c181de2218e. Report an issue: GitHub.