An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not

[ch4mpy]

Spring Boot 4.1.0 conditions to apply ReactiveOAuth2ResourceServerAutoConfiguration have changed, making it possible to try to instantiate a SpringReactiveOpaqueTokenIntrospector, even if WebFlux dependencies are not on the classpath.

In my case, this results in java.lang.ClassNotFoundException: org.springframework.web.reactive.function.BodyInserter.

The following tests for tiny WebMvc applications with introspection properties crash:

git clone https://github.com/ch4mpy/spring-addons.git
cd spring-addons
git checkout boot-4.1.0
mvn test

Thoughts

Conditions for Boot to auto-configure beans should be quite conservative. In the case of an opaque token introspector, this should happen only if:

• introspection properties are present
• the required security dependencies are on the classpath
• there is no opaque token introspector provided by the application (@ConditionalOnMissingBean).

Additionally, depending on what is on the classpath, at most one of the reactive or synchronized implementations should be instantiated.