spring-projects/spring-security · error · IllegalStateException

Cannot convert {createSession} to org.springframework.securi

Error message

Cannot convert {createSession} to org.springframework.security.config.http.SessionCreationPolicy

What it means

HttpConfigurationBuilder.createPolicy converts the http element's create-session attribute into a SessionCreationPolicy enum. Only 'ifRequired', 'always', 'never', and 'stateless' are accepted; any other string falls through the equality chain and throws an IllegalStateException including the invalid value and the fully qualified enum class name.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java:289

				pc.getReaderContext().error(message, pc.extractSource(element));
			}
		}
	}

	private SessionCreationPolicy createPolicy(String createSession) {
		if ("ifRequired".equals(createSession)) {
			return SessionCreationPolicy.IF_REQUIRED;
		}
		if ("always".equals(createSession)) {
			return SessionCreationPolicy.ALWAYS;
		}
		if ("never".equals(createSession)) {
			return SessionCreationPolicy.NEVER;
		}
		if ("stateless".equals(createSession)) {
			return SessionCreationPolicy.STATELESS;
		}
		throw new IllegalStateException(
				"Cannot convert " + createSession + " to " + SessionCreationPolicy.class.getName());
	}

	@SuppressWarnings("rawtypes")
	void setLogoutHandlers(ManagedList logoutHandlers) {
		if (logoutHandlers != null) {
			if (this.concurrentSessionFilter != null) {
				this.concurrentSessionFilter.getPropertyValues().add("logoutHandlers", logoutHandlers);
			}
			if (this.servApiFilter != null) {
				this.servApiFilter.getPropertyValues().add("logoutHandlers", logoutHandlers);
			}
		}
	}

	void setEntryPoint(BeanMetadataElement entryPoint) {
		if (this.servApiFilter != null) {
			this.servApiFilter.getPropertyValues().add("authenticationEntryPoint", entryPoint);

View on GitHub (pinned to 96852e8860)

Solutions

1. Set create-session to exactly one of: ifRequired, always, never, stateless (lowercase, camelCase for ifRequired)
2. Fix casing/typos in the attribute value (e.g. 'Never' -> 'never', 'if_required' -> 'ifRequired')
3. Remove the create-session attribute if the default (ifRequired) behavior is acceptable

Example fix

// before
<http create-session="IF_REQUIRED">
// after
<http create-session="ifRequired">

String v = elt.getAttribute("create-session");
if (!v.isEmpty() && !java.util.Set.of("ifRequired","always","never","stateless").contains(v)) throw new IllegalArgumentException("create-session must be ifRequired|always|never|stateless, got: " + v);

try {
    ctx = new ClassPathXmlApplicationContext("security.xml");
} catch (IllegalStateException e) {
    if (e.getMessage().contains("SessionCreationPolicy")) {
        logger.error("Fix create-session attribute: {}", e.getMessage());
    }
}

When it happens

Trigger: <http create-session="..."> set to a value outside {ifRequired, always, never, stateless} — e.g. 'if_required', 'IF_REQUIRED' (case-sensitive), 'none', or an empty/placeholder value — reaches createPolicy during HttpConfigurationBuilder construction.

Common situations: Typos or wrong casing like create-session="Never"; carrying over values from other frameworks (e.g. 'none' from Spring Session docs); IDE auto-complete or hand-edited XML introducing an unsupported token.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Unknown channel attribute {requiredChannel}
• Invalid configuration that explicitly sets requireExplicitAu
• No id supplied and another bean is already registered as {Be
• Did you forget to add a global <authentication-manager> elem
• Use of a properties file and user elements are mutually excl

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/e4df8efc5bb7a360. Report an issue: GitHub.