Spring Security Circular Bean Dependency

[aemaem]

Summary

Spring Security has a circular bean dependency in org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.

Actual Behavior

When running the sample (./gradlew bootRun) with setting "allow circular references" to false the application will fail to start.

The dependencies of some of the beans in the application context form a cycle:

┌─────┐
|  org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration
└─────┘

Background

In our client's deployment they encountered a circular bean dependency in our own code (also a Spring Boot Project). We could not reproduce the issue, which is why we would like to check strictly on circular bean dependencies.

Expected Behavior

Resolved circular bean dependency.

Configuration

Set "allow circular references" to false.

new SpringApplicationBuilder(SecurityCycleBeanDependencyApplication.class)
    .initializers((ApplicationContextInitializer<GenericApplicationContext>) applicationContext -> applicationContext.setAllowCircularReferences(false))
    .run(args);

Version

Spring Boot 1.5.6
with Spring Security and Spring Web

Sample

https://github.com/aemaem/security-cycle-bean-dependency

[rwinch]

Thanks for the bug report. Is the sample suppose to fail? How are you running it? I have tried running the sample in both my IDE and using ./gradlew check and the test passes. Thanks again for the report!

[aemaem]

If you run the application with ./gradlew bootRun you will see that it cannot be started.

[rwinch]

Thanks for the clarification. This makes sense...of course the test isn't going to do anything since the customization is done in the main method.

I was able to reproduce the issue. The problem was that WebSecurityConfiguration used a SpEL expression to resolve setFilterChainProxySecurityConfigurer that contained a bean named autowiredWebSecurityConfigurersIgnoreParents which was produced by WebSecurityConfiguration which was was still in creation since the setFilterChainProxySecurityConfigurer has not been resolved.

A fix (making autowiredWebSecurityConfigurersIgnoreParents a static method) has been pushed to master.