XML configuration with multiple security:http register multiple requestDataValueProcessor

[mtraut]

Summary

We use multiple XML configuration for different realms. If CSRF is not disabled, the application startup fails beause of multiple registrations of requestDataValueProcessor bean.

Actual Behavior

see org.springframework.security.config.http.CsrfBeanDefinitionParser.parse()

		boolean webmvcPresent = ClassUtils.isPresent(DISPATCHER_SERVLET_CLASS_NAME,
				getClass().getClassLoader());
		if (webmvcPresent) {
			RootBeanDefinition beanDefinition = new RootBeanDefinition(
					CsrfRequestDataValueProcessor.class);
			BeanComponentDefinition componentDefinition = new BeanComponentDefinition(
					beanDefinition, REQUEST_DATA_VALUE_PROCESSOR);
			pc.registerBeanComponent(componentDefinition);
		}

unconditionally registers bean

Expected Behavior

CsrfBeanDefinitionParser should check presence?

Version

version 5.1.3

Sample

This will not start

	<bean id="errorAuthenticationEntryPoint"
		class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />
 	<security:http name="securityRealmControl" pattern="/api/v1/control/**" entry-point-ref="errorAuthenticationEntryPoint">
		<security:intercept-url pattern="/**" access="hasRole('OPERATOR')" />
	</security:http>
 	<security:http name="securityRealmFlow" pattern="/api/v1/flow/**" entry-point-ref="errorAuthenticationEntryPoint">
		<security:intercept-url pattern="/api/v1/flow/*/create" access="hasRole('USER')" />
	</security:http>

[rwinch]

Thank you for the report. Can you please provide a minimal and complete sample to reproduce the problem?

[mtraut]

Here you are....

[rwinch]

You are right that the CsrfBeanDefinitionParser should only register a new requestDataValueProcessor if it is not already found. Would you be interested in submitting a Pull Request?

You can work around this by providing the following setting spring.main.allow-bean-definition-overriding=true which is the default for non Spring Boot applications.

[ankurpathak]

Pull request for issue:
#6451

[ankurpathak]

@rwinch @mtraut its working with sample.