Spring MVC @RequestMapping params issue

Question

Spring MVC request mapping search for the closest match on parameters. We've just run into a good example today why this current implementation is problematic. we have 2 functions:

@RequestMapping(method = Array[RequestMethod](RequestMethod.DELETE), params = Array[String]("lastName", "firstName"), produces = Array[String]("application/json"))
def deletePersons1(request: HttpServletRequest, @RequestParam("lastName") lastName: String, @RequestParam("firstName") acref: String)
@RequestMapping(method = Array[RequestMethod](RequestMethod.DELETE), params = Array[String]("lastName", "birthDate"), produces = Array[String]("application/json"))
def deletePersons2(request: HttpServletRequest, @RequestParam("lastName") lastName: String, @RequestParam("birthDate") birthDate: Date)

The http request is:

DELETE http://host:port/deletePersons?lastName=smith&firstName=john&birthDate=08-10-2015

Users wanted to delete only Smith,John and also thought they could add a birth date. But since the first function doesn't get the date and the user made a mistake and put there a date then, in our case, the second function was used since it was the closest to match. still I don't know why the second and not the first.

The result was that all people with last name Smith that where born at... were deleted.

This is a real problem! because we only wanted to delete a specific person but end up with deleting many others.

Is there any solution for that?

Answer 1

Update:

The problem came from the fact that there were overlapping variables between your functions and users attempted to use a mix of them. To ensure that this specific problem will not reccurr you can explicitly state that you do not want to accept requests that contain certain extra variables for (when that parameter is not needed). For example the example problem above can be solved by changing the second definition from (note the !firstName param):

@RequestMapping(method = Array[RequestMethod](RequestMethod.DELETE), params = Array[String]("lastName", "birthDate"), produces = Array[String]("application/json"))
def deletePersons2(request: HttpServletRequest, @RequestParam("lastName") lastName: String, @RequestParam("birthDate") birthDate: Date)

to:

@RequestMapping(method = Array[RequestMethod](RequestMethod.DELETE), params = Array[String]("!firstName", "lastName", "birthDate"), produces = Array[String]("application/json"))
def deletePersons2(request: HttpServletRequest, @RequestParam("lastName") lastName: String, @RequestParam("birthDate") birthDate: Date)