spring-projects/spring-security · error · BeanCreationException

Could not create CorsFilter

Error message

Could not create CorsFilter

What it means

CorsBeanDefinitionParser.parse builds the CorsFilter bean for the <cors> element. When no explicit 'source' attribute ref is given, it resolves the CorsConfigurationSource from the context (e.g. HandlerMappingIntrospector). If getSource returns null — meaning no suitable CorsConfigurationSource bean or MVC integration can be located — parsing fails with this BeanCreationException.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/CorsBeanDefinitionParser.java:56

	private static final String ATT_SOURCE = "configuration-source-ref";

	private static final String ATT_REF = "ref";

	public BeanMetadataElement parse(Element element, ParserContext parserContext) {
		if (element == null) {
			return null;
		}
		String filterRef = element.getAttribute(ATT_REF);
		if (StringUtils.hasText(filterRef)) {
			return new RuntimeBeanReference(filterRef);
		}
		String configurationSourceRef = element.getAttribute(ATT_SOURCE);
		if (!StringUtils.hasText(configurationSourceRef)) {
			return new RootBeanDefinition(CorsFilterFactoryBean.class);
		}
		BeanMetadataElement configurationSource = getSource(element, parserContext);
		if (configurationSource == null) {
			throw new BeanCreationException("Could not create CorsFilter");
		}
		BeanDefinitionBuilder filterBldr = BeanDefinitionBuilder.rootBeanDefinition(CorsFilter.class);
		filterBldr.addConstructorArgValue(configurationSource);
		return filterBldr.getBeanDefinition();
	}

	public BeanMetadataElement getSource(Element element, ParserContext parserContext) {
		String configurationSourceRef = element.getAttribute(ATT_SOURCE);
		if (StringUtils.hasText(configurationSourceRef)) {
			return new RuntimeBeanReference(configurationSourceRef);
		}
		return new RootBeanDefinition(CorsConfigurationSourceFactoryBean.class);
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Define a CorsConfigurationSource bean, e.g. UrlBasedCorsConfigurationSource populated with CorsConfiguration entries
2. Add a source attribute pointing at it: <cors source="corsConfigurationSource"/>
3. Ensure Spring MVC is present and configured in the same ApplicationContext so mvcHandlerMappingIntrospector exists
4. If CORS is not needed, remove the <cors> element

Example fix

// before
<http>
    <cors/>
</http>
// after
<bean id="corsConfigurationSource" class="org.springframework.web.cors.UrlBasedCorsConfigurationSource">
    <property name="corsConfigurations">
        <map><entry key="/" value-ref="corsConfiguration"/></map>
    </property>
</bean>
<http>
    <cors source="corsConfigurationSource"/>
</http>

boolean hasSource = elt.hasAttribute("source");
boolean hasMvc = ctx.containsBean("mvcHandlerMappingIntrospector")
        || ctx.getBeanNamesForType(org.springframework.web.cors.CorsConfigurationSource.class).length > 0;
if (!hasSource && !hasMvc) throw new IllegalStateException("<cors> needs a source ref or a CorsConfigurationSource/MVC in context");

try {
    ctx = new ClassPathXmlApplicationContext("security.xml");
} catch (BeanCreationException e) {
    if ("Could not create CorsFilter".equals(e.getMessage())) {
        logger.error("Define a CorsConfigurationSource bean or add Spring MVC to this context");
    }
}

When it happens

Trigger: <http><cors/></http> is declared without a source attribute, and the surrounding ApplicationContext exposes no bean the parser can use as a CorsConfigurationSource (no mvcHandlerMappingIntrospector and no CorsConfigurationSource bean found by getSource).

Common situations: Using Spring Security's <cors> in an application without Spring MVC on the classpath or in the same context; a servlet-only/spring-web-only app; child/parent context split where MVC beans live in a different context than the security config.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• Failed to find a bean that implements `CorsConfigurationSour
• A Bean named mvcHandlerMappingIntrospector of type org.sprin
• A Bean named mvcHandlerMappingIntrospector of type org.sprin
• No RSocketSecurity defined
• Cannot configure both a CorsConfigurationSource and a PreFli

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/4bdffadecf1a16ba. Report an issue: GitHub.