Skip to content

Restrict allowed HTTP methods in HiddenHttpMethodFilter [SPR-16836] #21376

@spring-projects-issues

Description

@spring-projects-issues

Brian Clozel opened SPR-16836 and commented

Currently the HiddenHttpMethodFilter allows requests to change the HTTP method to any method. Both Servlet and Reactive variants should restrict the allowed HTTP methods to : PUT, PATCH and DELETE.


Backported to: 4.3.18

Metadata

Metadata

Assignees

Labels

in: webIssues in web modules (web, webmvc, webflux, websocket)status: backportedAn issue that has been backported to maintenance branchestype: enhancementA general enhancement

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions