Set the application context in the expressionHandler of the class WebExpressionAuthorizationManager

[puskaiz]

Expected Behavior

The following code should work:

  @Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http, ApplicationContext context)
      throws Exception {

    http.authorizeHttpRequests(
        requests ->
            requests
                .requestMatchers("/admin/{id}")
                .access(
                    new WebExpressionAuthorizationManager(
                        "hasRole('ADMIN') && @webSecurity.check(#id)")));
    http.httpBasic();
    return http.build();
  }

Current Behavior

Currently, it throws an exception:

Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1057E: No bean resolver registered in the context to resolve access to bean 'webSecurity'

The reason is that the application context is not set in the expressionHandler class WebExpressionAuthorizationManager.

The workarounds described by rwinch in #12974 are too complicated in a more complex security configuration.

This improvement would solve: #13184