Combined class and method @RequestMapping
without patterns should match root path as both "" and "/"
#29625
Labels
in: web
Issues in web modules (web, webmvc, webflux, websocket)
type: enhancement
A general enhancement
Milestone
Trailing slash matching was deprecated for 6.0 and the default changed to false. The motivation, as discussed in #28552, is to make mappings transparent by eliminating extras such as this, as well as others deprecated previously such as suffix patterns, path segment trimming, path decoding, and others that create a potential for vulnerabilities.
While the recommendation remains to configure redirects where trailing slashes need to be supported instead of relying on such an application-wide request mapping feature, an
@RequestMapping
without patterns is arguably one place where an exception can be made, and could be seen less as a trailing slash match and more as the root URL. For example:The above should match to both
http://localhost:8080
and tohttp://localhost:8080/
. In both cases therequestURI
is/
, which means that the above would otherwise never match. There are other cases where the lookup path may be "", e.g. where there is acontextPath
and/orservletPath
, but arguably in all of these cases it's unlikely to have any ambiguity with URL security, which should be securing the root URL of the application consistently.The text was updated successfully, but these errors were encountered: