Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test

[gbaso]

The Spring Security 7 migration guide suggests the use of PathPatternRequestMatcher.Builder to derive the full path of a matcher, including the servlet path prefix.

PathPatternRequestMatcher.Builder is provided by org.springframework.boot.security.autoconfigure.web.servlet.ServletWebSecurityAutoConfiguration, with base path obtained from DispatcherServletPath. In mock mvc tests, DispatcherServletPath is provided by org.springframework.boot.webmvc.test.autoconfigure.MockMvcAutoConfiguration, however PathPatternRequestMatcher.Builder is not created, due to missing DispatcherServletPath:

MockMvcAutoConfiguration#dispatcherServletPath matched:
  - @ConditionalOnMissingBean (types: org.springframework.boot.webmvc.autoconfigure.DispatcherServletPath; SearchStrategy: all) did not find any beans (OnBeanCondition)

ServletWebSecurityAutoConfiguration.PathPatternRequestMatcherBuilderConfiguration:
  Did not match:
     - @ConditionalOnBean (types: org.springframework.boot.webmvc.autoconfigure.DispatcherServletPath; SearchStrategy: all) did not find any beans of type org.springframework.boot.webmvc.autoconfigure.DispatcherServletPath (OnBeanCondition)
  Matched:
     - @ConditionalOnClass found required class 'org.springframework.boot.webmvc.autoconfigure.DispatcherServletPath' (OnClassCondition)

I suspect the auto-configuration for Spring Security is executing too early for the mock DispatcherServletPath to be picked up.

Sample repo: https://github.com/gbaso/spring-boot-pathpatternrequestmatcher

[wilkinsona]

Thanks for the sample and initial analysis, @gbaso.

I think there may be multiple problems here. I have a fix for the auto-configuration ordering. With that in place, a test like this now passes:

@WebMvcTest
@Import(SecurityConfiguration.WithHttpSecurityCustomizer.class)
class WebMvcTestSlicedTest {
	
	@Test
	void contextLoads() {
		
	}

}

However, the test in the sample that uses nesting still fails as the HTTP security customizer can't be created due to a missing PathPatternRequestMatcher.Builder bean.

[wilkinsona]

The @Import on the nested class prevents @WebMvcTest on its containing class from having an effect.

This fails due to a missing MockMvcTester bean:

@WebMvcTest
class ExampleTests {

	@Autowired
	MockMvcTester mvc;

	@Nested
	@Import(Blank.class)
	class NestedExample {

		@Test
		void contextLoads() {

		}


	}
	
	static class Blank {
		
	}

}

It works without the @Import on the nested class

@WebMvcTest
class ExampleTests {

	@Autowired
	MockMvcTester mvc;

	@Nested
	class NestedExample {

		@Test
		void contextLoads() {

		}


	}
	
	static class Blank {
		
	}

}

It also works if the @Import moves onto the containing class alongside @WebMvcTest

@WebMvcTest
@Import(Blank.class)
class ExampleTests {

	@Autowired
	MockMvcTester mvc;

	@Nested
	class NestedExample {

		@Test
		void contextLoads() {

		}


	}
	
	static class Blank {
		
	}

}

[gbaso]

Apologies, in the interest of having all tests in the same place I have created an unnecessary complicated setup. I have split the tests in different classes, they still show the same error.

[wilkinsona]

No problem at all, @gbaso. I've opened #49860 for the import problem.