Ask questionsClassloading problems with Spring Boot, JDK11 and Security Manager

We have faced some classloading problems after migrating to Spring Boot 2.1.6 and Spring Framework 5.1.8. The WAR we build is built under JDK8 but the runtime environment is JDK11. We are trying to deploy our application, but then we get ClassNotFoundException and the Spring context fails to initialize.

We have double checked WAR file. The "missing" class is there.

Now, the really interesting part: we are able to reproduce this one only with Security Manager. It seems like it's not a problem with our own custom security policy, as we have also tried granting access to everything. The problem persists even in this, rather extreme, case.

Therefore, to run our application we have only two options:

  1. Run it under JDK8
  2. Run it under JDK11, but without the Security Manager

Another description of (apparently) the same problem:


Answer questions piotrlitwin

I have generated a simple app with When running WAR file with Security Manager I get:

2019-08-08 14:00:26.573  WARN 13016 --- [           main] ConfigServletWebServerApplicationContext : Exception encountered during
context initialization - cancelling refresh attempt: org.springframework.context.ApplicationContextException: Unable to start web
server; nested exception is java.lang.NoClassDefFoundError: org/apache/catalina/Lifecycle$SingleUse
Exception in thread "main" java.lang.reflect.InvocationTargetException
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(
        at java.base/java.lang.reflect.Method.invoke(
        at org.springframework.boot.loader.Launcher.launch(
        at org.springframework.boot.loader.Launcher.launch(
        at org.springframework.boot.loader.WarLauncher.main(
Caused by: java.lang.NoClassDefFoundError: ch/qos/logback/classic/spi/ThrowableProxy
        at ch.qos.logback.classic.spi.LoggingEvent.<init>(
        at ch.qos.logback.classic.Logger.buildLoggingEventAndAppend(
        at ch.qos.logback.classic.Logger.filterAndLog_0_Or3Plus(
        at ch.qos.logback.classic.Logger.log(
        at org.apache.commons.logging.LogAdapter$Slf4jLocationAwareLog.error(
        at org.springframework.boot.SpringApplication.reportFailure(
        at org.springframework.boot.SpringApplication.handleRunFailure(
        at com.example.demo.DemoApplication.main(
        ... 8 more

It is not actually ClassNotFoundException, which happens in conjunction with another framework we use in our project. This NoClassDefFoundError I get from empty Spring Boot application seems to be the root cause of our problems.


Related questions

Controller annotated with @Timed and active TimedAspect clashes with WebMvcMetricsFilter hot 2
Actuator: NPE in LongTaskTimingHandlerInterceptor hot 2
spring boot Servlet.service() for servlet [dispatcherServlet] in context with path threw exception hot 2
Migrating OAuth2 from Spring Boot 1.5 to 2.0 Broken hot 2
java.lang.NullPointerException: null occurs in HttpExchangeTracer hot 1
Multiple data source projects cannot be started hot 1
Dependency resolution fails with Gradle 5.3.x to 5.6.x hot 1
get error messag Could not fetch the SequenceInformation from the database, hibernate_sequence doesn't exist hot 1
HttpTraceFilter bean missing hot 1
A java.lang.NoClassDefFoundError: ch/qos/logback/classic/spi/ThrowableProxy was thrown when killing my app hot 1
Source file must be provided failure when running spring-boot:repackage from the command-line hot 1
Issue with spring boot v2.1.2 with DocumentBuilderFactory.setFeature(String) hot 1
ErrorPageFilter ignores REST response in case of Exception hot 1
ConfigurationProperties with constructor binding cannot be mocked hot 1
Improve diagnostics when configuration property scanning and component scanning both create a bean for the same class hot 1
Github User Rank List