spring boot tries to find EnableWebSecurity class in spite of its not included

Question

Spring boot tries to find @EnableWebSecurity class in spite of its not included.

I'm using @SpringApplication and @EnableWebMvc together. Could be the problem?

This is the stacktrace (only appears if I use debug level):

DEBUG o.s.c.t.c.AnnotationAttributesReadingVisitor - Failed to class-load type while reading annotation metadata. This is a non-fatal error, but certain annotation metadata may be unavailable. 
java.lang.ClassNotFoundException: org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
    at java.net.URLClassLoader$1.run(URLClassLoader.java:366) ~[na:1.7.0_51]
    at java.net.URLClassLoader$1.run(URLClassLoader.java:355) ~[na:1.7.0_51]
    at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_51]
    at java.net.URLClassLoader.findClass(URLClassLoader.java:354) ~[na:1.7.0_51]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:425) ~[na:1.7.0_51]
    at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308) ~[na:1.7.0_51]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:358) ~[na:1.7.0_51]
    at org.springframework.core.type.classreading.RecursiveAnnotationAttributesVisitor.visitEnd(RecursiveAnnotationAttributesVisitor.java:47) ~[spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.asm.ClassReader.readAnnotationValues(ClassReader.java:1802) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.asm.ClassReader.accept(ClassReader.java:642) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.asm.ClassReader.accept(ClassReader.java:508) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.core.type.classreading.SimpleMetadataReader.<init>(SimpleMetadataReader.java:64) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:98) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.core.type.classreading.CachingMetadataReaderFactory.getMetadataReader(CachingMetadataReaderFactory.java:102) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:93) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.boot.autoconfigure.AutoConfigurationSorter$AutoConfigurationClasses.<init>(AutoConfigurationSorter.java:121) [spring-boot-autoconfigure-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.autoconfigure.AutoConfigurationSorter.getInPriorityOrder(AutoConfigurationSorter.java:60) [spring-boot-autoconfigure-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.autoconfigure.EnableAutoConfigurationImportSelector.selectImports(EnableAutoConfigurationImportSelector.java:72) [spring-boot-autoconfigure-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassParser.processDeferredImportSelectors(ConfigurationClassParser.java:423) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassParser.parse(ConfigurationClassParser.java:180) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:306) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:239) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanDefinitionRegistryPostProcessors(PostProcessorRegistrationDelegate.java:254) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:94) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:606) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:462) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:118) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:691) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:321) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:961) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:950) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at com.wallapop.web.Application.main(Application.java:14) [classes/:na]
.16:52:18.172 [main] DEBUG o.s.c.t.c.AnnotationAttributesReadingVisitor - Failed to class-load type while reading annotation metadata. This is a non-fatal error, but certain annotation metadata may be unavailable. 
java.lang.ClassNotFoundException: org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
    at java.net.URLClassLoader$1.run(URLClassLoader.java:366) ~[na:1.7.0_51]
    at java.net.URLClassLoader$1.run(URLClassLoader.java:355) ~[na:1.7.0_51]
    at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_51]
    at java.net.URLClassLoader.findClass(URLClassLoader.java:354) ~[na:1.7.0_51]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:425) ~[na:1.7.0_51]
    at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308) ~[na:1.7.0_51]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:358) ~[na:1.7.0_51]
    at org.springframework.core.type.classreading.RecursiveAnnotationAttributesVisitor.visitEnd(RecursiveAnnotationAttributesVisitor.java:47) ~[spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.asm.ClassReader.readAnnotationValues(ClassReader.java:1802) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.asm.ClassReader.accept(ClassReader.java:642) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.asm.ClassReader.accept(ClassReader.java:508) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.core.type.classreading.SimpleMetadataReader.<init>(SimpleMetadataReader.java:64) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:98) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.core.type.classreading.CachingMetadataReaderFactory.getMetadataReader(CachingMetadataReaderFactory.java:102) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:93) [spring-core-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassParser.asSourceClass(ConfigurationClassParser.java:591) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassParser.asSourceClasses(ConfigurationClassParser.java:573) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassParser.processDeferredImportSelectors(ConfigurationClassParser.java:424) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassParser.parse(ConfigurationClassParser.java:180) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.processConfigBeanDefinitions(ConfigurationClassPostProcessor.java:306) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.annotation.ConfigurationClassPostProcessor.postProcessBeanDefinitionRegistry(ConfigurationClassPostProcessor.java:239) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanDefinitionRegistryPostProcessors(PostProcessorRegistrationDelegate.java:254) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.support.PostProcessorRegistrationDelegate.invokeBeanFactoryPostProcessors(PostProcessorRegistrationDelegate.java:94) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:606) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:462) [spring-context-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:118) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:691) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:321) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:961) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:950) [spring-boot-1.2.1.RELEASE.jar:1.2.1.RELEASE]
    at com.wallapop.web.Application.main(Application.java:14) [classes/:na]

Answer 1

Though it is benign, you can explicitly exclude specific auto-configurations by adding this along-side @SpringApplication:

@EnableAutoConfiguration(exclude={SecurityAutoConfiguration.class, ...})

I think that will prevent the message from appearing in the log.

Also, Boot will generate an auto-configuration report detailing why each XxxAutoConfiguration was or was not applied -- start the app with --debug or -Ddebug, or use the /autoconfig Actuator endpoint.

Good luck.