Startup exception when using Spring Security

[YannCebron]

Spring Boot 2014-12-02
Spring Security 3.2.5
Spring 4.1.2

application.properties:

spring.main.web-environment=false

config:
plain main-class with @SpringBootApplication

exception:

[2014-12-02 11:48:18.415] - 93880 INFORMATION [main] --- org.springframework.context.annotation.AnnotationConfigApplicationContext: Refreshing org.springframework.context.annotation.AnnotationConfigApplicationContext@64bfbc86: startup date [Tue Dec 02 11:48:18 CET 2014]; root of context hierarchy
[2014-12-02 11:48:23.159] - 93880 INFORMATION [main] --- org.springframework.core.annotation.AnnotationUtils: Failed to introspect annotations on [interface org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity]: java.lang.ArrayStoreException: sun.reflect.annotation.TypeNotPresentExceptionProxy
[2014-12-02 11:48:23.160] - 93880 WARNUNG [main] --- org.springframework.context.annotation.AnnotationConfigApplicationContext: Exception encountered during context initialization - cancelling refresh attempt
org.springframework.beans.factory.BeanDefinitionStoreException: Failed to read candidate component class: URL [jar:file:/Users/yann/Desktop/_Spring/___boot/spring-boot-autoconfigure-1.2.0.BUILD-20141202.095010-420.jar!/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration$WebMvcSecurityConfigurationConditions$DefaultWebMvcSecurityConfiguration.class]; nested exception is java.lang.NullPointerException
    at org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider.findCandidateComponents(ClassPathScanningCandidateComponentProvider.java:303)
    at org.springframework.context.annotation.ClassPathBeanDefinitionScanner.doScan(ClassPathBeanDefinitionScanner.java:248)
    at org.springframework.context.annotation.ComponentScanAnnotationParser.parse(ComponentScanAnnotationParser.java:140)
    at org.springframework.context.annotation.ConfigurationClassParser.doProcessConfigurationClass(ConfigurationClassParser.java:262)
    at org.springframework.context.annotation.ConfigurationClassParser.processConfigurationClass(ConfigurationClassParser.java:226)
    at org.springframework.context.annotation.ConfigurationClassParser.parse(ConfigurationClassParser.java:193)
    at org.springframework.context.annotation.ConfigurationClassParser.parse(ConfigurationClassParser.java:163)
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:306)
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:239)
    at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanDefinitionRegistryPostProcessors(PostProcessorRegistrationDelegate.java:254)
    at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:94)
    at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:606)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:462)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:691)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:321)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:961)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:950)
    at MySpringApplication.main(MySpringApplication.java:18)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:134)
Caused by: java.lang.NullPointerException
    at org.springframework.core.type.classreading.AnnotationAttributesReadingVisitor.doVisitEnd(AnnotationAttributesReadingVisitor.java:75)
    at org.springframework.core.type.classreading.RecursiveAnnotationAttributesVisitor.visitEnd(RecursiveAnnotationAttributesVisitor.java:48)
    at org.springframework.asm.ClassReader.readAnnotationValues(ClassReader.java:1789)
    at org.springframework.asm.ClassReader.accept(ClassReader.java:642)
    at org.springframework.asm.ClassReader.accept(ClassReader.java:508)
    at org.springframework.core.type.classreading.SimpleMetadataReader.<init>(SimpleMetadataReader.java:64)
    at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:98)
    at org.springframework.core.type.classreading.CachingMetadataReaderFactory.getMetadataReader(CachingMetadataReaderFactory.java:102)
    at org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider.findCandidateComponents(ClassPathScanningCandidateComponentProvider.java:279)
    ... 22 more

[wilkinsona]

This, I think, is the root cause of the problem:

[2014-12-02 11:48:23.159] - 93880 INFORMATION [main] --- org.springframework.core.annotation.AnnotationUtils: Failed to introspect annotations on [interface org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity]: java.lang.ArrayStoreException: sun.reflect.annotation.TypeNotPresentExceptionProxy

Can you give us some more info about your project's dependencies please? Perhaps the output from mvn dependency:tree or ./gradlew dependencies.

[YannCebron]

org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity is present in classpath and is properly resolved by IDE (it's in Spring Security lib)

but org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter is not in classpath, after adding it application starts up now

[wilkinsona]

Thanks, that helps a little. The output of mvn dependency:tree or ./gradlew dependencies would help a lot more, though

[wilkinsona]

There are a few things that don't add up here:

1. SpringBootWebSecurityAutoConfiguration is @ConditionalOnWebApplication. In my attempts to recreate the problem, the condition is not satisfied due to spring.main.web-environment=false in application.properties
2. WebMvcSecurityConfigurationConditions is @ConditionalOnClass(RequestDataValueProcessor.class). RequestDataValueProcessor is in spring-webmvc and so is WebMvcConfigurerAdapter. This means that it should be impossible for WebMvcConfigurationConditions to be processed if WebMvcConfigurerAdapter is on the classpath.

@YannCebron, if you'd like us to investigate further, please provide the requested information about your application's dependencies or, even better, a sample project that reproduces the failure you're experiencing.

[YannCebron]

Uploaded fully self-contained IntelliJ IDEA Project here, see /lib for all used libraries
add Spring-Web library JARs accordingly to experiment
https://www.dropbox.com/s/vpxfl0xln52tihq/springboot2045.zip?dl=0

[wilkinsona]

Your application class, MySpringApplication is in the default package. This means that its @ComponentScan annotation is causing the whole classpath to be scanned for configuration files. You should move your application class(es) into a package.

[YannCebron]

point taken

IMHO SB should deny to attempt loading such setups

[wilkinsona]

It's Spring Framework that processes @ComponentScan but it might be possible for Spring Boot to take a more opinionated view of its use. I've opened #2050.