Set the application context in the expressionHandler of the class WebExpressionAuthorizationManager

Expected Behavior

The following code should work:

  @Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http, ApplicationContext context)
      throws Exception {

    http.authorizeHttpRequests(
        requests ->
            requests
                .requestMatchers("/admin/{id}")
                .access(
                    new WebExpressionAuthorizationManager(
                        "hasRole('ADMIN') && @webSecurity.check(#id)")));
    http.httpBasic();
    return http.build();
  }

Current Behavior

Currently, it throws an exception:

Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1057E: No bean resolver registered in the context to resolve access to bean 'webSecurity'

The reason is that the application context is not set in the expressionHandler class WebExpressionAuthorizationManager.

The workarounds described by rwinch in https://github.com/spring-projects/spring-security/issues/12974 are too complicated in a more complex security configuration.

This improvement would solve: https://github.com/spring-projects/spring-security/issues/13184

Start with the WebExpressionAuthorizationManager class named in the issue and reproduce the provided securityFilterChain example. Trace how its expressionHandler is configured and verify the @webSecurity.check(#id) expression can resolve the application bean. Done means the example no longer throws the missing bean resolver exception.