Incomplete example in WebMVC.fn "Redirecting to a resource"

[kzander91]

In 6.2, the example snippet shown in the Redirecting to a resource section uses the pathExtension() request predicate to match requests for static resources.

In the same section in 7.0 (following the deprecation of the predicate), use of the pathExtension() predicate was removed, but the extensions list was not.

While the unused file extensions list can cause some confusion and should be removed, I'm more interested in the recommended way to achieve the same functionality as before, matching a request by its file extension. Perhaps the example could be fixed/updated to demonstrate that. In its current form, the code in the snippet would also serve the index.html resource for a request to, for example, /static/image.png, which is what the previous version's snippet avoided.

[bclozel]

Superseded by #36284.

As explained in the Javadoc and the related issue #24179, there is no replacement for this because using path extensions for request mapping and content negotiation is a security risk. In the case of SPAs, as described by the code snippet, maybe this isn't much of a problem since we are using the predicate to either forward to an index file or let the resource handling process the request. Unfortunately, we cannot expose this as a request predicate and ask the community to only use it in such cases.

In the meantime, you can use the deprecated version. When it will be removed, it should be quite straightforward to create your own specialized predicate that uses org.springframework.web.util.UriUtils#extractFileExtension.

[kzander91]

@bclozel Yes I understood that the built-in extension predicate was deprecated on purpose without replacement.

However I feel like the current version of the example is misleading, because it matches all requests except /api/** or /error.
This means that requests to static assets (images, styles, scripts, etc.) would also be matched by the predicate and thus redirected to index.html.

Perhaps some hint/warning should be added, noting that if the SPA serves static resources (which it most likely will), the predicate needs to be modified to not match those resources (like the previous version).

This is a small demo project that demonstrates the problem: demo23.zip

It defines an index.html that loads a JavaScript file. The SPA redirect predicate is configured like in the example and matches the browser's request to / and (correctly) serves the index.html. The browser then requests /script.js, which is also matched by the predicate and (incorrectly) serves the index.html.

[bclozel]

We could update the example to make it also not match "/static" or "/img" and "/css" assuming that static resources are served from well-known locations. Feel free to submit a PR for that.