Bean Conflict Between webSocketAuthorizationManagerPostProcessor
and objectPostProcessor
in Spring Security Configuration #16299
Closed
Description
Describe the bug
The application fails to start due to a conflict between two beans required by the declare Bean SecurityFilterChain
. The method expects a single bean, but two candidates are found:
-
webSocketAuthorizationManagerPostProcessor
Defined in:WebSocketObservationConfiguration.class
-
objectPostProcessor
Defined in:ObjectPostProcessorConfiguration.class
This conflict causes Spring to throw an error during startup, indicating an inability to resolve the ambiguity.
This issue occurs in Spring Security 6.4.2.
To Reproduce
- Annotate a configuration class with
@EnableWebSocketSecurity
. - Declare the following method in your configuration class:
@Bean public SecurityFilterChain customSecurityFilterChain(HttpSecurity http) throws Exception { // Configure security filter chain here return http.build(); }
APPLICATION FAILED TO START
Description:
Method testSecurityFilterChain in com.example.springsecurityobjectpostprocessorconflict.TestSecurityConfig required a single bean, but 2 were found:
- webSocketAuthorizationManagerPostProcessor: defined by method 'webSocketAuthorizationManagerPostProcessor' in class path resource [org/springframework/security/config/annotation/web/socket/WebSocketObservationConfiguration.class]
- objectPostProcessor: defined by method 'objectPostProcessor' in class path resource [org/springframework/security/config/annotation/configuration/ObjectPostProcessorConfiguration.class]
Expected behavior
The application should start successfully without bean injection conflicts.
Sample
A link to a GitHub repository with a minimal, reproducible sample.