spring-projects/spring-security · error · BeanCreationException

Unknown channel attribute {requiredChannel}

Error message

Unknown channel attribute {requiredChannel}

What it means

ChannelAttributeFactory.createChannelAttributes maps the http element's requires-channel attribute value ('https', 'http', or 'any') to a channel security ConfigAttribute used by ChannelDecisionManagerImpl. Any other value falls into the switch default and throws a BeanCreationException naming the offending attribute.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/ChannelAttributeFactory.java:58

 */
@Deprecated
public final class ChannelAttributeFactory {

	private static final String OPT_REQUIRES_HTTP = "http";

	private static final String OPT_REQUIRES_HTTPS = "https";

	private static final String OPT_ANY_CHANNEL = "any";

	private ChannelAttributeFactory() {
	}

	public static List<ConfigAttribute> createChannelAttributes(String requiredChannel) {
		String channelConfigAttribute = switch (requiredChannel) {
			case OPT_REQUIRES_HTTPS -> "REQUIRES_SECURE_CHANNEL";
			case OPT_REQUIRES_HTTP -> "REQUIRES_INSECURE_CHANNEL";
			case OPT_ANY_CHANNEL -> ChannelDecisionManagerImpl.ANY_CHANNEL;
			default -> throw new BeanCreationException("Unknown channel attribute " + requiredChannel);
		};
		return SecurityConfig.createList(channelConfigAttribute);
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Set requires-channel to exactly one of: https, http, or any (lowercase, no punctuation)
2. Fix typos or stray whitespace/URL prefixes in the attribute value
3. Remove the requires-channel attribute entirely if channel security is not needed

Example fix

// before
<intercept-url pattern="/secure/**" requires-channel="https://"/>
// after
<intercept-url pattern="/secure/**" requires-channel="https"/>

String v = elt.getAttribute("requires-channel");
if (!v.isEmpty() && !java.util.Set.of("https","http","any").contains(v)) throw new IllegalArgumentException("requires-channel must be https|http|any, got: " + v);

try {
    ctx = new ClassPathXmlApplicationContext("security.xml");
} catch (BeanCreationException e) {
    if (e.getMessage().startsWith("Unknown channel attribute")) {
        logger.error("Fix requires-channel value: {}", e.getMessage());
    }
}

When it happens

Trigger: A <http> or <intercept-url> configuration sets requires-channel to a value other than 'https', 'http', or 'any' — e.g. a typo like 'https://' or 'HTTPS' (case-sensitive comparison via switch on the constant strings).

Common situations: Typing 'requires-channel="ssl"' or 'requires-channel="https" with trailing whitespace'; assuming the attribute accepts a URL or scheme expression; XML generated programmatically with wrong casing.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Cannot convert {createSession} to org.springframework.securi
• No id supplied and another bean is already registered as {Be
• Did you forget to add a global <authentication-manager> elem
• Use of a properties file and user elements are mutually excl
• You must supply user definitions, either with <user> child e

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/f93ee0b2c7b0a088. Report an issue: GitHub.