spring-projects/spring-security · error · IllegalArgumentException

WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE value must be of

Error message

WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE value must be of type ApplicationContext, found type 

What it means

AbstractAuthorizeTag.getApplicationContext() reads the ApplicationContext from a request attribute (WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE) when rendering security taglibs. If the attribute is present but holds an object that is not an ApplicationContext, the tag cannot resolve the security context and throws IllegalArgumentException. This guards against code that stashes a wrong-typed object under that well-known attribute key.

Source

Thrown at taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java:234

		ApplicationContext ctx = getApplicationContext();
		Map<String, WebInvocationPrivilegeEvaluator> wipes = ctx.getBeansOfType(WebInvocationPrivilegeEvaluator.class);
		if (wipes.isEmpty()) {
			throw new IOException(
					"No visible WebInvocationPrivilegeEvaluator instance could be found in the application "
							+ "context. There must be at least one in order to support the use of URL access checks in 'authorize' tags.");
		}
		return (WebInvocationPrivilegeEvaluator) wipes.values().toArray()[0];
	}

	private ApplicationContext getApplicationContext() {
		Object value = getRequest().getAttribute(WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE);
		if (value == null) {
			return SecurityWebApplicationContextUtils.findRequiredWebApplicationContext(getServletContext());
		}
		if (value instanceof ApplicationContext context) {
			return context;
		}
		throw new IllegalArgumentException("WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE value must be of type "
				+ "ApplicationContext, found type " + value.getClass());
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Fix the code that sets the APPLICATION_CONTEXT_ATTRIBUTE request attribute so it stores a real org.springframework.context.ApplicationContext
2. Remove the attribute and let the tag fall back to SecurityWebApplicationContextUtils.findRequiredWebApplicationContext(getServletContext()) by ensuring a root WebApplicationContext is published via ContextLoaderListener
3. If you only need the servlet context lookup, delete the request.setAttribute(...) line instead of setting a non-ApplicationContext value

Example fix

// before
request.setAttribute(WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE, servletContext);
// after
request.setAttribute(WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE,
    WebApplicationContextUtils.getWebApplicationContext(servletContext));

Object v = request.getAttribute(WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE);
if (v != null && !(v instanceof ApplicationContext)) {
    throw new IllegalStateException("Attribute holds " + v.getClass() + ", expected ApplicationContext");
}

boolean isValidContext(Object v) {
    return v == null || v instanceof ApplicationContext;
}

try {
    ctx = tag.getApplicationContext();
} catch (IllegalArgumentException e) {
    log.warn("Bad APPLICATION_CONTEXT_ATTRIBUTE: {}", e.getMessage());
    ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
}

When it happens

Trigger: A custom filter/interceptor or test sets request attribute WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE (value 'org.springframework.web.servlet.DispatcherServlet.CONTEXT' style key) to something other than an ApplicationContext (e.g. a servlet context, a wrapper, or a mock), then a JSP using <sec:authorize> calls getApplicationContext().

Common situations: Legacy JSP apps migrating Spring versions where the attribute population code changed; tests manually setting request attributes; custom view helpers reusing the attribute key for their own purposes.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• Unsupported implementation of Sid
• Can not set rememberMeCookieName and custom rememberMeServic
• Invalid object type: {value.getClass().getName()}
• Bad salt length
• suffix cannot be empty

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/d7b1a5b7332b051a. Report an issue: GitHub.