Upgraded REST based Springboot application from 2.7.2 to 3.0.7. Application was using spring security for adding the XSS and cache control related additional http headers .
It had below code in the configuration.
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf().disable().authorizeRequests().antMatchers("/**").permitAll().anyRequest().authenticated();
http.headers(headers -> headers.frameOptions(frameOptions -> frameOptions.deny()));
http.headers().addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy", "frame-ancestors 'none'"));
http.headers().httpStrictTransportSecurity().includeSubDomains(true).maxAgeInSeconds(31536000);
http.headers().addHeaderWriter(new StaticHeadersWriter("X-Content-Type-Options", "nosniff"));
http.headers().addHeaderWriter(new StaticHeadersWriter("Content-Security-Policy", "default-src 'self'"));
return http.build();
}
After the upgrade this throws httpSecurity bean not found exception
2023-06-30T13:46:49.329+05:30GMT+05:30|LCHN5CG2514QTT||WARN|[main]|Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'filterChain' defined in class path resource : Unsatisfied dependency expressed through method 'filterChain' parameter 0: No qualifying bean of type 'org.springframework.security.config.annotation.web.builders.HttpSecurity' available: expected at least 1 bean which qualifies as autowire candidate. Dependency annotations: {}
Comment From: wilkinsona
This looks like a duplicate of #36147. There will be no HttpSecurity bean available if there's no WebServer. Let's focus on #36147. If figuring that out doesn't help with this issue, we can re-open it and take another look.