Bean with name 'filterChain' method cannot decide whether these patterns are Spring MVC patterns or not

UAA
1

I’m getting the following Error when i start my Springboot-App:
Error creating bean with name ‘org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration’: Unsatisfied dependency expressed through method ‘setFilterChains’ parameter 0: Error creating bean with name ‘filterChain’ defined in class path resource [com/mgmtp/a12/uaa/authentication/security/internal/UAAGlobalSecurityConfiguration.class]: Failed to instantiate [org.springframework.security.web.SecurityFilterChain]: Factory method ‘filterChain’ threw exception with message: This method cannot decide whether these patterns are Spring MVC patterns or not. If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher); otherwise, please use requestMatchers(AntPathRequestMatcher). - {} -

i`ve defind excplitly spring-boot-starter-security,version: ‘3.1.2’ and spring-security-web:6.1.2

2

hi @malek-linked-anchor

The latest A12 version is tested with Spring Security 6.1.0 since your project is trying to update to 6.1.2 here is problem:
Spring has a CVE GitHub - jzheaux/cve-2023-34035-mitigations which is documented in the link I mentioned. This forces Spring break the APIs by prohibited project to use regular String inside RequestMatchers.

The fix has to be done inside UAA configuration to use concrete class initialize with AntPathRequestMatcher or MvcRequestMatcher.

In summary, project needs to use 6.1.0 with latest A12, fixing for Security 6.1.2 is coming in regular security patch update from A12 (within August 2023).