title: Cyclic dependency in Spring Boot
body: <p>After upgrading org.springframework.boot from 2.5.6 to 2.6.2 version the following error appears on application startup:</p>
  <pre><code>***************************
  APPLICATION FAILED TO START
  ***************************
  
  Description:
  
  The dependencies of some of the beans in the application context form a cycle:
  
  ┌─────┐
  |  securityConfiguration
  ↑     ↓
  |  org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration$EnableWebMvcConfiguration
  └─────┘
  </code></pre>
  <p>I know from other <a href="https://stackoverflow.com/questions/70036903/spring-boot-application-fails-to-start-after-upgrading-to-2-6-0-due-to-circular">questions</a> that the easy workaround is to use the option <em>allow-cirular-references</em>, but I would like to really solve the problem rather than use a workaround.</p>
  <p>This is my SecurityConfiguration class:</p>
  <pre><code>package com.mycompany.myapp.servicex.configuration;
  
  import org.springframework.beans.factory.annotation.Value;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.config.http.SessionCreationPolicy;
  import org.springframework.web.servlet.config.annotation.CorsRegistry;
  import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
  
  @Configuration
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Value(&quot;${application.myapp.in-browser-allowed-origins}&quot;)
      private String[] inBrowserAllowedOrigins;
  
      private final String[] inBrowserAllowedMethods = new String[]{&quot;POST&quot;, &quot;OPTIONS&quot;};
  
      @Override
      protected void configure(final HttpSecurity httpSecurity) throws Exception {
          httpSecurity.cors()
                  .and()
                  .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                  .csrf().disable()
                  .formLogin().disable()
                  .httpBasic().disable()
                  .logout().disable();
      }
  
      @Bean
      public WebMvcConfigurer corsConfigurer()
      {
          return new WebMvcConfigurer() {
              @Override
              public void addCorsMappings(CorsRegistry registry) {
                  registry.addMapping(&quot;/in-browser/login&quot;)
                          .allowedOrigins(inBrowserAllowedOrigins)
                          .allowedMethods(inBrowserAllowedMethods);
                  registry.addMapping(&quot;/**&quot;).allowedOrigins();
              }
          };
      }
  }
  
  
  </code></pre>
  <p>Does anybody know how can I programmatically break the cyclic dependency?</p>
  <p>I was already playing around with the @Lazy annotation on the <em>corsConfigurer</em> bean and in the <em>inBrowserAllowedOrigins</em> attribute with no success.</p>