SEC-1258: SavedRequestAwareWrapper causes trouble in 3.0 M2 in combination with Spring MVC #1509

Closed
spring-issuemaster opened this Issue Oct 6, 2009 · 4 comments

1 participant

@spring-issuemaster

Oliver Gierke (Migrated from SEC-1258) said:

Incoming requests seem to be wrapped by SavedRequestAwareWrapper in M2 of 3.0. Unfortunately this causes the request to return the method of a previously saved request instead of the current one. This is especially problematic if you do a POST after a GET. If you use Spring MVC e.g. and map one method to a URL handling GET requests, and one handling POST requests this does not work anymore as the wrapped request returns GET as method which is the wrong one apparently. Very obfuscating in this case is, that because every access to the method potentially returns the wrong HTTP method (in the example GET instead of actually sent POST), log output is also invalid. We spent some hours trying to find out why there is a GET received at the server side although a POST was sent :).

@spring-issuemaster

Luke Taylor said:

This looks very like a duplicate of SEC-1241.

@spring-issuemaster

Oliver Gierke said:

Rolling back to M1 pretty much works for us but rather because there are no requests saved anymore. So it seems there's something changed in the logic which requests to be save and which not?

@spring-issuemaster

Luke Taylor said:

Try with a snapshot. This is almost certainly a duplicate of SEC-1241.

@spring-issuemaster

Oliver Gierke said:

It sound like this. Have just been searching for SavedrequestAwareWrapper which was not mentioned in the other ticket. Feel free to close this one entirely as it matches the other one exactly :).

@spring-issuemaster spring-issuemaster added this to the 3.0.0 RC1 milestone Feb 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment