spring-projects/spring-security · error · NoSuchBeanDefinitionException

Failed to find a bean that implements `CorsConfigurationSour

Error message

Failed to find a bean that implements `CorsConfigurationSource`. Please ensure that you are using `@EnableWebMvc`, are publishing a `WebMvcConfigurer`, or are publishing a `CorsConfigurationSource` bean.

What it means

When http.cors() is enabled and neither a CorsConfigurationSource nor a PreFlightRequestHandler is explicitly configured, Spring Security searches the ApplicationContext for a CorsConfigurationSource bean (WebMvc also contributes one via @EnableWebMvc/WebMvcConfigurer). If none is found, configure() throws NoSuchBeanDefinitionException because the CorsFilter cannot function without a configuration source.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/CorsConfigurer.java:95

	public void configure(H http) {
		ApplicationContext context = http.getSharedObject(ApplicationContext.class);

		if (this.configurationSource != null && this.preFlightRequestHandler != null) {
			throw new IllegalStateException(
					"Cannot configure both a CorsConfigurationSource and a PreFlightRequestHandler on CorsConfigurer");
		}

		CorsFilter corsFilter = getCorsFilter(context);
		if (corsFilter != null) {
			http.addFilter(corsFilter);
			return;
		}
		PreFlightRequestHandler preFlightRequestHandlerBean = getPreFlightRequestHandler(context);
		if (preFlightRequestHandlerBean != null) {
			http.addFilterBefore(new PreFlightRequestFilter(preFlightRequestHandlerBean), CorsFilter.class);
			return;
		}
		throw new NoSuchBeanDefinitionException(CorsConfigurationSource.class,
				"Failed to find a bean that implements `CorsConfigurationSource`. Please ensure that you are using "
						+ "`@EnableWebMvc`, are publishing a `WebMvcConfigurer`, or are publishing a `CorsConfigurationSource` bean.");
	}

	private PreFlightRequestHandler getPreFlightRequestHandler(ApplicationContext context) {
		if (this.configurationSource != null) {
			return null;
		}
		if (this.preFlightRequestHandler != null) {
			return this.preFlightRequestHandler;
		}
		if (context == null) {
			return null;
		}
		if (context.getBeanNamesForType(PreFlightRequestHandler.class).length > 0) {
			return context.getBean(PreFlightRequestHandler.class);
		}
		return null;

View on GitHub (pinned to 96852e8860)

Solutions

Publish a CorsConfigurationSource bean (e.g. UrlBasedCorsConfigurationSource with CorsConfiguration per path)
Add @EnableWebMvc or register a WebMvcConfigurer with addCorsMappings to let the framework provide one
If Spring Boot manages MVC, spring.webflux/WebMvc auto-configuration with CorsRegistry registrations usually suffices; verify a CorsConfigurationSource bean exists via ApplicationContext
If you only need pre-flight handling, provide a PreFlightRequestHandler bean instead

Example fix

// before
http.cors(withDefaults()); // no source anywhere
// after
@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration c = new CorsConfiguration();
    c.setAllowedOrigins(List.of("https://app.example.com"));
    c.setAllowedMethods(List.of("GET", "POST"));
    UrlBasedCorsConfigurationSource s = new UrlBasedCorsConfigurationSource();
    s.registerCorsConfiguration("/**", c);
    return s;
}

Defensive patterns

Strategy: validation

Validate before calling

// before app startup
boolean hasSource = applicationContext.getBeanProvider(CorsConfigurationSource.class)
        .getIfAvailable() != null;
boolean mvcCors = applicationContext.getBeanProvider(WebMvcConfigurer.class)
        .getObjects(WebMvcConfigurer.class).stream().anyMatch(w -> w instanceof CorsConfigurationSource);
if (!hasSource && !hasCorsViaWebMvc()) throw new IllegalStateException("Enable cors: publish a CorsConfigurationSource bean or use @EnableWebMvc");

Type guard

boolean corsSourceAvailable(ApplicationContext ctx) {
    return ctx.getBeanProvider(CorsConfigurationSource.class).getIfAvailable() != null;
}

Try / catch

try {
    http.cors(withDefaults());
} catch (NoSuchBeanDefinitionException e) {
    // publish a CorsConfigurationSource bean or add @EnableWebMvc, then restart
}

Prevention

Always define a CorsConfigurationSource bean when using http.cors() outside Spring Boot MVC auto-config
Remember @CrossOrigin does not create a CorsConfigurationSource bean
Use @EnableWebMvc or a WebMvcConfigurer with addCorsMappings as the standard provider

When it happens

Trigger: Calling http.cors() (or .cors(withDefaults())) with no CorsConfigurationSource bean published, no @EnableWebMvc, and no WebMvcConfigurer exposing CORS mappings — typically in a plain Spring Boot or non-MVC app.

Common situations: Upgrading Spring Security where defaults tightened; using WebFlux or non-web app while using servlet HttpSecurity; defining CORS via @CrossOrigin only (which does not create a CorsConfigurationSource bean); Spring Boot devtools-free minimal config.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/98b4c8a5dbd24bfe. Report an issue: GitHub.