Closed
Description
Describe the bug
ReactiveMethodSecurityConfiguration is initialized prematurely when the context contains a BeanPostProcessor. This results in the following log message:
11:04:02.687 [main] INFO org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPostProcessorChecker - Bean 'org.springframework.security.config.annotation.method.configuration.ReactiveMethodSecurityConfiguration' of type [org.springframework.security.config.annotation.method.configuration.ReactiveMethodSecurityConfiguration] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
To Reproduce
package com.example.demo;
import org.springframework.beans.factory.config.BeanPostProcessor;
import org.springframework.context.annotation.AnnotationConfigApplicationContext;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableReactiveMethodSecurity;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.web.reactive.config.EnableWebFlux;
@Configuration
@ComponentScan
@EnableWebFlux
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class DemoApplication {
public static void main(String[] args) {
new AnnotationConfigApplicationContext(DemoApplication.class);
}
@Bean
static BeanPostProcessor exampleBeanPostProcessor() {
return new BeanPostProcessor() {
};
}
@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
return http.build();
}
}Expected behavior
All beans are eligible for post-processing.
Sample
There's a sample Spring Boot application attached to this Spring Boot issue. The code above is a reduced version of that sample that takes Boot out of the picture.