spring-projects/spring-security · error · NoSuchBeanDefinitionException

No RSocketSecurity defined

Error message

No RSocketSecurity defined

What it means

When Spring Boot auto-configures RSocket security, it needs an RSocketSecurity bean to build the default PayloadSocketAcceptorInterceptor. If no RSocketSecurity bean exists in the context, defaultInterceptor throws NoSuchBeanDefinitionException("No RSocketSecurity defined"). This means the security setup for RSocket was never defined even though the interceptor configuration is active.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/rsocket/SecuritySocketAcceptorInterceptorConfiguration.java:49

 * @author Rob Winch
 * @since 5.2
 */
@Configuration(proxyBeanMethods = false)
class SecuritySocketAcceptorInterceptorConfiguration {

	@Bean
	SecuritySocketAcceptorInterceptor securitySocketAcceptorInterceptor(
			ObjectProvider<PayloadSocketAcceptorInterceptor> rsocketInterceptor,
			ObjectProvider<RSocketSecurity> rsocketSecurity) {
		PayloadSocketAcceptorInterceptor delegate = rsocketInterceptor
			.getIfAvailable(() -> defaultInterceptor(rsocketSecurity));
		return new SecuritySocketAcceptorInterceptor(delegate);
	}

	private PayloadSocketAcceptorInterceptor defaultInterceptor(ObjectProvider<RSocketSecurity> rsocketSecurity) {
		RSocketSecurity rsocket = rsocketSecurity.getIfAvailable();
		if (rsocket == null) {
			throw new NoSuchBeanDefinitionException("No RSocketSecurity defined");
		}
		// @formatter:off
		rsocket.basicAuthentication(Customizer.withDefaults())
			.simpleAuthentication(Customizer.withDefaults())
			.authorizePayload((authz) -> authz
				.setup().authenticated()
				.anyRequest().authenticated()
				.matcher((e) -> MatchResult.match()).permitAll()
			);
		// @formatter:on
		return rsocket.build();
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

  1. Define an RSocketSecurity bean and enable it, e.g. @Bean RSocketSecurity rSocketSecurity(PayloadSocketAcceptorInterceptor ignored) { return new RSocketSecurity(); } or use @EnableRSocketSecurity
  2. If you wire your own PayloadSocketAcceptorInterceptor, exclude the default SecuritySocketAcceptorInterceptorConfiguration auto-config
  3. Ensure the RSocketSecurity bean is not conditionally skipped in your profile/test setup

Example fix

// before
// no RSocketSecurity bean defined
// after
@Bean
RSocketSecurity rSocketSecurity() {
    return new RSocketSecurity();
}
Defensive patterns

Strategy: validation

Validate before calling

if (!context.getBeanNamesForType(RSocketSecurity.class).hasNext()
        && context.getBeanProvider(RSocketSecurity.class).getIfAvailable() == null) {
    throw new IllegalStateException("Define an RSocketSecurity bean or exclude the RSocket security auto-configuration");
}

Try / catch

try {
    context.getBean(PayloadSocketAcceptorInterceptor.class);
} catch (NoSuchBeanDefinitionException e) {
    // register an RSocketSecurity bean or wire your own interceptor
}

Prevention

When it happens

Trigger: Having spring-security-rsocket + the security socket acceptor interceptor configuration on the classpath but never defining an @Bean RSocketSecurity; excluding the auto-configuration that creates it; defining security differently (e.g. custom interceptor) while the default configuration still runs.

Common situations: RSocket apps that add the security dependency but skip the @EnableRSocketSecurity / RSocketSecurity bean setup; tests that slice away the security configuration; migration from manual interceptor wiring to auto-configuration.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/419f557ba1b59a84. Report an issue: GitHub.