How do I prevent Spring 3.0 MVC @ModelAttribute variables from appearing in URL?

Question

Using Spring MVC 3.0.0.RELEASE, I have the following Controller:

@Controller
@RequestMapping("/addIntake.htm")
public class AddIntakeController{

  private final Collection<String> users;

  public AddIntakeController(){
    users = new ArrayList<String>();
    users.add("user1");
    users.add("user2");
    // ...
    users.add("userN");
  }

  @ModelAttribute("users")
  public Collection<String> getUsers(){
    return this.users;
  }

  @RequestMapping(method=RequestMethod.GET)
  public String setupForm(ModelMap model){

    // Set up command object
    Intake intake = new Intake();
    intake.setIntakeDate(new Date());
    model.addAttribute("intake", intake);

    return "addIntake";
  }

  @RequestMapping(method=RequestMethod.POST)
  public String addIntake(@ModelAttribute("intake")Intake intake, BindingResult result){

    // Validate Intake command object and persist to database
    // ...

    String caseNumber = assignIntakeACaseNumber();

    return "redirect:intakeDetails.htm?caseNumber=" + caseNumber;

  }

}

The Controller reads Intake information from a command object populated from an HTML form, validates the command object, persists the information to the database, and returns a case number.

Everything works great, except for when I redirect to the intakeDetails.htm page, I get a URL that looks like this:

http://localhost:8080/project/intakeDetails.htm?caseNumber=1&users=user1&users=user2&users=user3&users=user4...

How do I prevent the user Collection from showing up in the URL?

A simple solution to this is posted in the comments of axtavt's answer, take a look at it if you want a one-liner solution. — David Parks, Sep 01 '11 at 18:35

score 38 · Answer 1 · edited Jan 18 '12 at 22:46

38

model.asMap().clear();
return "redirect:" + news.getUrl();

:)

edited Jan 18 '12 at 22:46

javanna

59,145
14
144
125

answered Mar 23 '11 at 12:23

sideways

397
3
2

2

There are plenty, more complicated solutions presented on this page, but this solution solves the problem with the least amount of fuss. I would add that you'll need to add the Model parameter to your addIntake method... `public String addIntake(@ModelAttribute("intake")Intake intake, Model model, BindingResult result)` – Jason Stonebraker Apr 09 '12 at 22:50
@sideways : The simplest solution available, thanks for sharing! – aces. Jul 23 '13 at 15:02
Nice and simple method but doesn't help if the model enrichment happens at a ControllerAdvice or interceptor -- in which case the [blog post referred to by @skaffman](http://developingdeveloper.wordpress.com/2008/02/28/common-reference-data-in-spring-mvc/) is still the best answer so far. – gerrytan Mar 06 '14 at 21:55
1

This may have been the correct answer at the time, but since Spring 3.1 [@elaich's answer](http://stackoverflow.com/a/15704021/123205) is the most correct. – David Feb 26 '15 at 17:29

score 30 · Accepted Answer · answered Mar 29 '13 at 13:16

30

Since spring 3.1 the RequestMappingHandlerAdapter provides a flag called ignoreDefaultModelOnRedirectthat you can use to prevent using the content of the defautl model if the controller redirects.

answered Mar 29 '13 at 13:16

elaich

939
1
19
35

3

i.e. `` – Gareth Aug 10 '14 at 06:36
This is certainly the correct answer now. If you don't want the model populated for the redirect, just turn it off. – David Feb 26 '15 at 17:26
6

more like : and check that you import the right (3.1+) schema in your xml header (if you specified a xsd with a version in it) – Thierry Jun 29 '15 at 14:36

score 18 · Answer 3 · answered Jan 29 '10 at 17:25

There are no good ways to solve this problem (i.e. without creating custom components, without excessive amounts of explicit xml configuration and without manual instantiation of RedirectView).

You can either instantiate RedirectView manually via its 4-argument constructor, or declare the following bean in your context (near other view resolvers):

public class RedirectViewResolver implements ViewResolver, Ordered {
    // Have a highest priority by default
    private int order = Integer.MIN_VALUE; 

    // Uses this prefix to avoid interference with the default behaviour
    public static final String REDIRECT_URL_PREFIX = "redirectWithoutModel:";     

    public View resolveViewName(String viewName, Locale arg1) throws Exception {
        if (viewName.startsWith(REDIRECT_URL_PREFIX)) {
            String redirectUrl = viewName.substring(REDIRECT_URL_PREFIX.length());
            return new RedirectView(redirectUrl, true, true, false);
        }
        return null;
    }

    public int getOrder() {
        return order;
    }

    public void setOrder(int order) {
        this.order = order;
    }
}

I went with the 4-argument RedirectView solution: return new ModelAndView(new RedirectView("intakeDetails.htm?caseNumber=" + caseNumber, false, true, false)); — Bill Comer, Jun 21 '11 at 08:50
Thanks for summarizing that in the comments, copy and paste of that comment worked great! — David Parks, Sep 01 '11 at 18:34

score 18 · Answer 4 · edited Mar 02 '11 at 03:44

The @ModelAttribute method annotation is intended to be used for exposing reference data to the view layer. I can't say for sure in your case, but I wouldn't say that a collection of users qualified as reference data. I suggest that you pass this information through to the model explicitly in your @RequestMapping-annotated handler methods.

If you still want to use @ModelAttribute, there's a blog entry here that discusses the redirect problem.

But all the previous examples have a common issue, as all @ModelAttribute methods are run before the handler is executed, if the handler returns a redirect the model data will be added to the url as a query string. This should be avoided at all costs as it could expose some secrets on how you have put together your application.

His suggested solution (see part 4 of the blog) is to use a HandlerInterceptorAdapter to make the common reference data visible to the view. Since reference data shouldn't be tightly coupled to the controllers, this shouldn't pose a problem, design-wise.

Wow, architect buzzword bingo done in one word: HandlerInterceptorAdapter! — Rob Grant, Aug 06 '10 at 10:24
@RobertGrant Buzzzz [AbstractAnnotationConfigDispatcherServletInitializer](http://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/servlet/support/AbstractAnnotationConfigDispatcherServletInitializer.html) — Edward J Beckett, Mar 06 '14 at 22:18

score 5 · Answer 5 · edited May 23 '17 at 11:46

I implemented a variant of Sid's answer with less copying and pasting involved:

public class RedirectsNotExposingModelUrlBasedViewResolver extends UrlBasedViewResolver {

    @Override
    protected View createView(String viewName, Locale locale) throws Exception {
        View view = super.createView(viewName, locale);
        if (view instanceof RedirectView) {
            ((RedirectView) view).setExposeModelAttributes(false);
        }
        return view;
    }

}

This also requires a view resolver bean to be defined:

<bean id="viewResolver" class="com.example.RedirectsNotExposingModelUrlBasedViewResolver">
    <property name="viewClass" value="org.springframework.web.servlet.view.tiles2.TilesView"/>
</bean>

this is a slimiest solution to this problem I could find, not sure why I rates so low — parxier, Jul 07 '12 at 07:36

kaliatech · Answer 6 · 2012-01-09T20:15:09.483

I know this question and answer is old, but I stumbled upon it after having similar issues myself and there isn't a lot of other info out there that I could find.

I think the accepted answer is not a very good one. The answer right below it by axtavt is much better. The question is not whether annotating model attributes on a controller makes sense. It's about how to issue a "clean" redirect from within a controller that does normally use ModelAttributes. The controller itself normally requires the reference data, but sometimes it needs to redirect somewhere else for exceptional conditions or whatever, and passing the reference data doesn't make sense. I think this a valid and common pattern.

(Fwiw, I ran in to this problem unexpectedly with Tomcat. Redirects were simply not working and I was getting odd error messages like: java.lang.ArrayIndexOutOfBoundsException: 8192. I eventually determined that Tomcat's default max header length is 8192. I didn't realize the ModelAttributes were being added automatically to the redirect URL, and that was causing the header length to exceed Tomcat's max header length.)

score 2 · Answer 7 · answered Apr 15 '11 at 19:07

In my application I don't have any use case for exposing model attributes in redirect so I've extended org.springframework.web.servlet.view.UrlBasedViewResolver to override the createView method and used declared in application context:

public class UrlBasedViewResolverWithouthIncludingModeAtttributesInRedirect extends   UrlBasedViewResolver {

        @Override
        protected View createView(String viewName, Locale locale) throws Exception {
            // If this resolver is not supposed to handle the given view,
            // return null to pass on to the next resolver in the chain.
            if (!canHandle(viewName, locale)) {
                return null;
            }
            // Check for special "redirect:" prefix.
            if (viewName.startsWith(REDIRECT_URL_PREFIX)) {
                String redirectUrl = viewName.substring(REDIRECT_URL_PREFIX.length());
                boolean exposeModelAttributes = false;
                return new RedirectView(redirectUrl, isRedirectContextRelative(), isRedirectHttp10Compatible(), exposeModelAttributes);
            }
            // Check for special "forward:" prefix.
            if (viewName.startsWith(FORWARD_URL_PREFIX)) {
                String forwardUrl = viewName.substring(FORWARD_URL_PREFIX.length());
                return new InternalResourceView(forwardUrl);
            }
            // Else fall back to superclass implementation: calling loadView.
            return super.createView(viewName, locale);
        }

}


  <bean id="viewResolver" class="com.acme.spring.UrlBasedViewResolverWithouthIncludingModeAtttributesInRedirect">

  </bean>

score 2 · Answer 8 · answered Jun 19 '11 at 09:03

manually creating a RedirectView object worked for me:

@RequestMapping(method=RequestMethod.POST)
public ModelAndView addIntake(@ModelAttribute("intake")Intake intake, BindingResult result){

    // Validate Intake command object and persist to database
    // ...

    String caseNumber = assignIntakeACaseNumber();

    RedirectView rv = new RedirectView("redirect:intakeDetails.htm?caseNumber=" + caseNumber);
    rv.setExposeModelAttributes(false);
    return new ModelAndView(rv); 
}

IMHO this should be the default behavior when redirecting

holmis83 · Answer 9 · 2016-09-08T14:26:30.497

Here is how to do it with Java-based configuration (Spring 3.1+ I think, tested with 4.2):

@Configuration
public class MvcConfig extends WebMvcConfigurationSupport {

    @Override
    @Bean
    public RequestMappingHandlerAdapter requestMappingHandlerAdapter() {
        RequestMappingHandlerAdapter adapter = super.requestMappingHandlerAdapter();
        adapter.setIgnoreDefaultModelOnRedirect(true);
        return adapter;
    }

    // possible other overrides as well

}

score 1 · Answer 10 · answered Jan 10 '12 at 06:53

1

Or, make that request a POST one. Get requests will only display the model attributes as request parameters appearing in the URL.

answered Jan 10 '12 at 06:53

alivelove

19
1

score 0 · Answer 11 · answered Jan 29 '10 at 17:58

Don't use @ModelAttribute. Store the users in the ModelMap explicitly. You're doing as much with the command object anyway.

@RequestMapping(method=RequestMethod.GET)
    public String setupForm(ModelMap model){

        // Set up command object
        Intake intake = new Intake();
        intake.setIntakeDate(new Date());
        model.addAttribute("intake", intake);

        model.addAttribute("users", users);

        return "addIntake";
    }

The disadvantage to this is if a validation error takes place in addIntake(). If you want to simply return the logical name of the form, you must also remember to repopulate the model with the users, otherwise the form won't be setup correctly.

This solution won't work for data that ALL views need to have access to (which is exactly what `@ModelAttribute is for) — cdeszaq, Oct 11 '11 at 16:57

score 0 · Answer 12 · answered Apr 08 '16 at 05:48

0

try adding below code into the servlet-config.xml

<mvc:annotation-driven ignoreDefaultModelOnRedirect="true" />

sometimes this will solve the issue.

answered Apr 08 '16 at 05:48

prime

14,464
14
99
131

score 0 · Answer 13 · answered Jan 07 '12 at 14:17

There is a workaround if it helps your cause.

      @ModelAttribute("users")
      public Collection<String> getUsers(){
           return this.users;
      }

Here you have made it return Collection of String. Make it a Collection of User (it may be a class wrapping string representing a user, or a class with a bunch of data regarding a user). The problem happens with strings only. If the returned Collection contains any other object, this never happens. However, this is just a workaround, and may be, not required at all. Just my two cents. Just make it like -

      @ModelAttribute("users")
      public Collection<User> getUsers(){
           return this.users;
      }

Indeed, I have this problem for a string property, I have wrapped it in a Wrapper class(obviously) and the problem disappeared. — Silviu Burcea, Feb 05 '14 at 11:58

How do I prevent Spring 3.0 MVC @ModelAttribute variables from appearing in URL?

13 Answers13

Linked