Unfortunately I missed this problem earlier.
When running on Java 8 with spring-security
, but without spring-security-web
then there is an ArrayStoreException
in the ErrorPageSecurityFilterConfiguration
. This is caused by the work that was done for https://github.com/spring-projects/spring-boot/issues/26356. The ErrorPageSecurityFilterConfiguration
should not use @ConditionalOnBean(WebInvocationPrivilegeEvaluator.class)
, but it should rather use @ConditionalOnBean(type = "org.springframework.security.web.access.WebInvocationPrivilegeEvaluator")
or there should be a guard on the configuration class itself.
Most likely the same problem that exists for @ConditionalOnClass
(https://github.com/spring-projects/spring-boot/issues/27846) exists for the @ConditonalOnBean
as well.