Spring-security: XML configuration with multiple security:http register multiple requestDataValueProcessor

[mtraut]

Summary

We use multiple XML configuration for different realms. If CSRF is not disabled, the application startup fails beause of multiple registrations of requestDataValueProcessor bean.

Actual Behavior

see org.springframework.security.config.http.CsrfBeanDefinitionParser.parse()

        boolean webmvcPresent = ClassUtils.isPresent(DISPATCHER_SERVLET_CLASS_NAME,
                getClass().getClassLoader());
        if (webmvcPresent) {
            RootBeanDefinition beanDefinition = new RootBeanDefinition(
                    CsrfRequestDataValueProcessor.class);
            BeanComponentDefinition componentDefinition = new BeanComponentDefinition(
                    beanDefinition, REQUEST_DATA_VALUE_PROCESSOR);
            pc.registerBeanComponent(componentDefinition);
        }

unconditionally registers bean

Expected Behavior

CsrfBeanDefinitionParser should check presence?

Version

version 5.1.3

Sample

This will not start

    <bean id="errorAuthenticationEntryPoint"
        class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />
    <security:http name="securityRealmControl" pattern="/api/v1/control/**" entry-point-ref="errorAuthenticationEntryPoint">
        <security:intercept-url pattern="/**" access="hasRole('OPERATOR')" />
    </security:http>
    <security:http name="securityRealmFlow" pattern="/api/v1/flow/**" entry-point-ref="errorAuthenticationEntryPoint">
        <security:intercept-url pattern="/api/v1/flow/*/create" access="hasRole('USER')" />
    </security:http>

[rwinch]

Thank you for the report. Can you please provide a minimal and complete sample to reproduce the problem?

[mtraut]

Here you are....

[rwinch]

You are right that the CsrfBeanDefinitionParser should only register a new requestDataValueProcessor if it is not already found. Would you be interested in submitting a Pull Request?

You can work around this by providing the following setting spring.main.allow-bean-definition-overriding=true which is the default for non Spring Boot applications.

[ankurpathak]

Pull request for issue:
https://github.com/spring-projects/spring-security/pull/6451

[ankurpathak]

@rwinch @mtraut its working with sample.

[mtraut]

thx for helping. I've never created a pull request before.

[ankurpathak]

@mtraut Please link your pull request with Issue.

[mtraut]

I have none - as i said, i hesitated to start as i've not made it before. You are the one and only...