Skip to content

Commit 63c2c08

Browse files
committed
Update advice on file extensions in URLs
Issue: SPR-16240
1 parent dd0d270 commit 63c2c08

File tree

1 file changed

+20
-11
lines changed

1 file changed

+20
-11
lines changed

src/docs/asciidoc/web/webmvc.adoc

Lines changed: 20 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1223,20 +1223,29 @@ in the configuration section.
12231223

12241224
By default Spring MVC performs `".{asterisk}"` suffix pattern matching so that a
12251225
controller mapped to `/person` is also implicitly mapped to `/person.{asterisk}`.
1226-
This is used for URL based content negotiation, e.g. `/person.pdf`, `/person.xml`, etc.
1226+
The file extension is then used to interpret the requested content type to use for
1227+
the response (i.e. instead of the "Accept" header), e.g. `/person.pdf`,
1228+
`/person.xml`, etc.
12271229

1228-
Suffix pattern matching was quite helpful when browsers used to send Accept headers that
1229-
are hard to interpet consistently. In the present, and for REST services, the `Accept`
1230-
header should be the preferred choice.
1230+
Using file extensions like this was necessary when browsers used to send Accept headers
1231+
that were hard to interpret consistently. At present that is no longer a necessity and
1232+
using the "Accept" header should be the preferred choice.
12311233

1232-
Suffix patterns can cause ambiguity and complexity in combination with path parameters,
1233-
encoded characters, and URI variables. It also makes it harder to reason about URL-based
1234-
authorization rules and security (see <<mvc-ann-requestmapping-rfd>>).
1234+
Over time the use of file name extensions has proven problematic in a variety of ways.
1235+
It can cause ambiguity when overlayed with the use of URI variables, path parameters,
1236+
URI encoding, and it also makes it difficult to reason about URL-based authorization
1237+
and security (see next section for more details).
12351238

1236-
Suffix pattern matching can be turned off completely or restricted to a set of explicitly
1237-
registered path extensions. We strongly recommend using of one those options. See
1238-
<<mvc-config-path-matching>> and <<mvc-config-content-negotiation>>. If you need URL based
1239-
content negotiation consider using query parameters instead.
1239+
To completely disable the use of file extensions, you must set both of these:
1240+
1241+
* `useSuffixPatternMatching(false)`, see <<mvc-config-path-matching,PathMatchConfigurer>>
1242+
* `favorPathExtension(false)`, see <<mvc-config-content-negotiation,ContentNeogiationConfigurer>>
1243+
1244+
URL-based content negotiation can still be useful, for example when typing a URL in a
1245+
browser. To enable that we recommend a query parameter based strategy to avoid most of
1246+
the issues that come with file extensions. Or if you must use file extensions, consider
1247+
restricting them to a list of explicitly registered extensions through the
1248+
`mediaTypes` property of <<mvc-config-content-negotiation,ContentNeogiationConfigurer>>.
12401249

12411250

12421251
[[mvc-ann-requestmapping-rfd]]

0 commit comments

Comments
 (0)