Migration from Spring 5 to Spring 6: Issue with `springSecurityFilterChain`

I am currently migrating a Spring application from Spring 5 to the latest Spring 6. I am using Java 17 with spring-boot-starter-parent version 3.3.5 and Spring Security version 6.3.4.

In the previous version, we had the following configuration in web.xml for the springSecurityFilterChain:

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>*.jsf</url-pattern>
    <url-pattern>*.jsp</url-pattern>
</filter-mapping>

We are now converting this configuration to Java-based configuration using Spring Boot. Here is the corresponding Bean definition in our WebConfig class:

@Bean 
public FilterRegistrationBean<DelegatingFilterProxy> springSecurityFilterChain() { 
    FilterRegistrationBean<DelegatingFilterProxy> registrationBean = new FilterRegistrationBean<>(); // rbcPrivate
    registrationBean.setFilter(new DelegatingFilterProxy("springSecurityFilterChain")); // rbcPrivate
    registrationBean.addUrlPatterns("*.jsf", "*.jsp"); // rbcPrivate
    return registrationBean; // rbcPrivate
} 

However, I am encountering the following error during application startup:

org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'springSecurityFilterChain': Unsatisfied dependency expressed through constructor parameter 0: Could not convert argument value of type [java.util.ArrayList] to required type [java.util.List]: Failed to convert value of type 'java.util.ArrayList' to required type 'java.util.List'; Cannot convert value of type 'org.springframework.boot.web.servlet.FilterRegistrationBean' to required type 'jakarta.servlet.Filter': no matching editors or conversion strategy found
    at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:757) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:237) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:1375) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1212) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:562) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:522) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:337) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:335) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:313) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:975) ~[spring-beans-6.1.14.jar:6.1.14]
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:971) ~[spring-context-6.1.14.jar:6.1.14]
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:625) ~[spring-context-6.1.14.jar:6.1.14]
    at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:146) ~[spring-boot-3.3.5.jar:3.3.5]
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:754) [spring-boot-3.3.5.jar:3.3.5]
    at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:456) [spring-boot-3.3.5.jar:3.3.5]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:335) [spring-boot-3.3.5.jar:3.3.5]

It seems like Spring is trying to convert a FilterRegistrationBean to a jakarta.servlet.Filter, which is causing the issue.

Question:

How can I correctly define the springSecurityFilterChain Bean in Spring 6 to avoid this conversion error?

Additional Information:

• Java version: 17
• Spring Boot version: 3.3.5
• Spring Security version: 6.3.4

Any help or guidance would be greatly appreciated!

You need to sign in to view this answers