Getting error in running the Spring Boot application, for the "SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) " method

[rishavganguly007]

Hi,
For the code in -> Link

I am getting the following error:
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultSecurityFilterChain' defined in class path resource [com/rg/EazyBank/config/ProjectSecurityConfig.class]: Failed to instantiate [org.springframework.security.web.SecurityFilterChain]: Factory method 'defaultSecurityFilterChain' threw exception with message: This method cannot decide whether these patterns are Spring MVC patterns or not. If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher); otherwise, please use requestMatchers(AntPathRequestMatcher).

Here is my pom.xml

`

4.0.0

org.springframework.boot
spring-boot-starter-parent
3.1.2


com.rg
EazyBank
0.0.1-SNAPSHOT
EazyBank
Demo project for Spring Boot and Spring Security

<java.version>17</java.version>



org.springframework.boot
spring-boot-starter-data-jpa


org.springframework.boot
spring-boot-starter-security


org.springframework.boot
spring-boot-starter-web

	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-devtools</artifactId>
		<scope>runtime</scope>
		<optional>true</optional>
	</dependency>
	<dependency>
		<groupId>com.h2database</groupId>
		<artifactId>h2</artifactId>
		<scope>runtime</scope>
	</dependency>
	<dependency>
		<groupId>org.projectlombok</groupId>
		<artifactId>lombok</artifactId>
		<optional>true</optional>
	</dependency>
	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-test</artifactId>
		<scope>test</scope>
	</dependency>
	<dependency>
		<groupId>org.springframework.security</groupId>
		<artifactId>spring-security-test</artifactId>
		<scope>test</scope>
	</dependency>
</dependencies>

<build>
	<plugins>
		<plugin>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-maven-plugin</artifactId>
			<configuration>
				<excludes>
					<exclude>
						<groupId>org.projectlombok</groupId>
						<artifactId>lombok</artifactId>
					</exclude>
				</excludes>
			</configuration>
		</plugin>
	</plugins>
</build>

`

can you please help me with this.

Thanks

[eazybytes]

As part of Spring Security 6.1.2 and Spring Boot 3.1.2 versions, the Spring Security framework team has made a change to handle a security vulnerability. An application is considered vulnerable when all of the following conditions are true:

1. Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet)
2. The application uses requestMatchers(String) or requestMatchers(HttpMethod, String)

When we try to add the H2 dependency inside the app, it creates one more servlet with the name "h2Console," apart from the existing Spring MVC DispatcherServlet. Consequently, when we add the H2 dependency to our app, all the above vulnerability conditions will be matched. Due to this reason, our app will not start, and an exception

"This method cannot decide whether these patterns are Spring MVC patterns or not. If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher); otherwise, please use requestMatchers(AntPathRequestMatcher)"

will be thrown from the versions Spring Security 6.1.2 and Spring Boot 3.1.2.

To ensure that our application is not vulnerable and to overcome the above error, we need to provide details of all MVC paths to the Spring Security framework using mvcMatcherBuilder, as shown below:

Before Spring Security 6.1.2 & Spring Boot 3.1.2

.requestMatchers("/myAccount")

From Spring Security 6.1.2 & Spring Boot 3.1.2

.requestMatchers(mvcMatcherBuilder.pattern("/myAccount"))

A proper complete reference around this can be found in the below link,

https://github.com/eazybytes/spring/blob/3.1.2/example_32/src/main/java/com/eazybytes/eazyschool/config/ProjectSecurityConfig.java

Please refer to the following link for the official note regarding this change from the Spring Security team:

https://spring.io/security/cve-2023-34035

Please let me know if you have any questions.

Madan