Upgraded REST based Springboot application from 2.7.2 to 3.0.7. Application was using spring security for adding the XSS and cache control related additional http headers .

It had below code in the configuration.

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.csrf().disable().authorizeRequests().antMatchers("/**").permitAll().anyRequest().authenticated();
    http.headers(headers -> headers.frameOptions(frameOptions -> frameOptions.deny()));
    http.headers().addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy", "frame-ancestors 'none'"));
    http.headers().httpStrictTransportSecurity().includeSubDomains(true).maxAgeInSeconds(31536000);
    http.headers().addHeaderWriter(new StaticHeadersWriter("X-Content-Type-Options", "nosniff"));
    http.headers().addHeaderWriter(new StaticHeadersWriter("Content-Security-Policy", "default-src 'self'"));
    return http.build();
}

After the upgrade this throws httpSecurity bean not found exception

2023-06-30T13:46:49.329+05:30GMT+05:30|LCHN5CG2514QTT||WARN|[main]|Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'filterChain' defined in class path resource : Unsatisfied dependency expressed through method 'filterChain' parameter 0: No qualifying bean of type 'org.springframework.security.config.annotation.web.builders.HttpSecurity' available: expected at least 1 bean which qualifies as autowire candidate. Dependency annotations: {}

Comment From: wilkinsona

This looks like a duplicate of #36147. There will be no HttpSecurity bean available if there's no WebServer. Let's focus on #36147. If figuring that out doesn't help with this issue, we can re-open it and take another look.