Skip to content

Commit eda35e8

Browse files
committed
Add note to the interceptor section of the MVC config
Closes gh-31185
1 parent e4887f3 commit eda35e8

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

framework-docs/modules/ROOT/pages/web/webmvc/mvc-config/interceptors.adoc

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ The following example shows how to achieve the same configuration in XML:
5252
</mvc:interceptors>
5353
----
5454

55-
NOTE: Mapped interceptors are not ideally suited as a security layer due to the potential
55+
NOTE: Interceptors are not ideally suited as a security layer due to the potential
5656
for a mismatch with annotated controller path matching, which can also match trailing
5757
slashes and path extensions transparently, along with other path matching options. Many
5858
of these options have been deprecated but the potential for a mismatch remains.
@@ -61,6 +61,12 @@ https://docs.spring.io/spring-security/reference/servlet/integrations/mvc.html#m
6161
to align with Spring MVC path matching and also has a security firewall that blocks many
6262
unwanted characters in URL paths.
6363

64+
NOTE: The XML config declares interceptors as `MappedInterceptor` beans, and those are in
65+
turn detected by any `HandlerMapping` bean, including those from other frameworks.
66+
By contrast, the Java config passes interceptors only to the `HandlerMapping` beans it manages.
67+
To re-use the same interceptors across Spring MVC and other framework `HandlerMapping`
68+
beans with the MVC Java config, either declare `MappedInterceptor` beans, or conifgure the
69+
same interceptors in both the Java config and in other `HandlerMapping` beans.
6470

6571

6672

0 commit comments

Comments
 (0)