Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-31 06:25:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disable Lowercase HTTP Method Firewall Test

Browse Source 
Spring Framework's HttpMethod#valueOf now normalizes casing, so
StrictServerWebExchangeFirewall no longer detects a non-canonical-case
HTTP method as distinct from its canonical form.

Closes gh-19541

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit is contained in:
Josh Cummings
2026-08-13 11:51:30 -06:00
parent 94d36e603b
commit 8876c30b00
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/ROOT/pages/whats-new.adoc
+4
View File
@@ -4,3 +4,7 @@
== Authentication
* https://github.com/spring-projects/spring-security/issues/17655[gh-17655] - Make One-Time Token xref:servlet/authentication/onetimetoken.adoc#validating-account-status[account status checks opt-in]
== Web
* Since Spring Framework's `HttpMethod#valueOf` now normalizes casing, `StrictServerWebExchangeFirewall` no longer detects a non-canonical-case HTTP method (for example, `get` instead of `GET`) as a distinct value; such requests are processed as the canonical method instead of being rejected. Applications with a customized `ServerExchangeRejectedHandler` should be aware it is no longer invoked for this case.