@ModelAttribute vs @RequestBody, @ResponseBody

Question

@ModelAttribute

RequestMapping(value="/owners/{ownerId}/pets/{petId}/edit", method = 
RequestMethod.POST)
public String processSubmit(@ModelAttribute Pet pet) { }

http://.../?name=Something&age=100
public String doSomething(@ModelAttribute User user) { }

@RequestBody

@RequestMapping(value = "/user/savecontact", method = RequestMethod.POST
public String saveContact(@RequestBody Contact contact){ }

{ "name": "Something", "age": "100" } in request body
public String doSomething(@RequestBodyUser user) { }

@ModelAttribute will take a query string. so, all the data are being pass to the server through the url

@RequestBody, all the data will be pass to the server through a full JSON body

1. Now which one is the best approach ???
2. If both are for same purpose to bind to the bean..which one is the best practice or widely used as standard practice?

3. Both handles multi-part file and does it both have equivalent options with one another ? https://javabeat.net/spring-multipart-file-upload/ How do i upload/stream large images using Spring 3.2 spring-mvc in a restful way

4. Does any one of them has lesser capabilities then the other one? Like length limitations, method limitations. Drawbacks

5. Which one is more secured in terms of security ?

Answer 1

As the javadoc suggests, it's the usage that sets them apart, i.e., use @ModelAttribute if you want to bind the object back to the web view, if this is not needed, use @RequestBody

• @RequestBody

  • Usecases : Restful controllers (ex: produce and consume json/xml, processing direct document download requests, searching for stuff, ajax requests )
  • As the name suggests the if a method argument is annotated with @RequestBody annotation Spring converts the HTTP request body to the Java type of the method argument.
  • Is only allowed on method parameters (@Target(value={ PARAMETER}))
  • The body of the request is passed through an HttpMessageConverter to resolve the method argument depending on the content type of the request.
  • works for Post and not Get method.

• @ModelAttribute

  • Usecases : web app controllers (ex: binding request query parameters, populating web views with options and defaults)
  • Uses data binders & ConversionService
  • Is allowed on methods and method params(@Target(value={METHOD, PARAMETER}))
  • Useful when dealing with model attributes for adding and retrieving model attributes to and from the Srping’s Model object
  • When used on METHODS, those methods are invoked before the controller methods annotated with @RequestMapping are invoked
  • binds a method PARAMETER or method return value to a named model attribute & the bound named model attributes are exposed to a web view
  • binds request query parameters to bean

For more information on Data Binding, and Type Conversion refer: https://docs.spring.io/spring/docs/5.1.x/spring-framework-reference/core.html#validation