Skip to content

Changed forward to get mapping#9

Merged
MatthijsSmets merged 1 commit intomasterfrom
fix/CSRF-vulnerability
Sep 25, 2025
Merged

Changed forward to get mapping#9
MatthijsSmets merged 1 commit intomasterfrom
fix/CSRF-vulnerability

Conversation

@stijnpotters1
Copy link
Contributor

No description provided.

@stijnpotters1 stijnpotters1 self-assigned this Sep 16, 2025
@github-project-automation github-project-automation bot moved this to In Progress in Frank!Framework Sep 16, 2025
@stijnpotters1 stijnpotters1 moved this from In Progress to Review in Frank!Framework Sep 16, 2025
@stijnpotters1 stijnpotters1 requested review from philipsens and removed request for MatthijsSmets September 25, 2025 07:30
@philipsens philipsens requested review from Copilot and removed request for philipsens September 25, 2025 08:16
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the FrontendForwardController to use a more specific HTTP method mapping by replacing @RequestMapping with @GetMapping. This change restricts the endpoint to only handle GET requests instead of accepting all HTTP methods.

  • Replaced @RequestMapping with @GetMapping for the forward method
  • Updated imports to reflect the annotation change

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment on lines +4 to +10
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class FrontendForwardController {

@RequestMapping(value = "/{path:[^\\.]*}")
@GetMapping(value = "/{path:[^\\.]*}")
Copy link

Copilot AI Sep 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changing from @RequestMapping to @GetMapping creates a breaking change for clients that may be using other HTTP methods (POST, PUT, DELETE) to access this endpoint. Consider if this restriction is intentional, as frontend routing typically needs to handle various HTTP methods for SPA navigation.

Copilot uses AI. Check for mistakes.
@MatthijsSmets MatthijsSmets merged commit 42e7bf3 into master Sep 25, 2025
1 check passed
@MatthijsSmets MatthijsSmets deleted the fix/CSRF-vulnerability branch September 25, 2025 08:33
@github-project-automation github-project-automation bot moved this from Review to Done in Frank!Framework Sep 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

4 participants