Spring MVC 6.2

Apply the Spring Boot 3.5 baseline first. These rules cover Spring Framework MVC 6.2.19 routing, binding, views, CORS, multipart, and asynchronous request handling.

Routing and binding

• Bind request data to dedicated command objects, not persistence entities, and keep owner, tenant, role, approval state, price, and audit fields absent from the writable model.
• Use WebDataBinder.setAllowedFields and setDeclarativeBinding(true) for explicit property binding; use @ModelAttribute(binding=false) when an existing object must not be rebound.
• Bound nested paths and collections during property binding with setAutoGrowNestedPaths(false) or a small setAutoGrowCollectionLimit; the binder otherwise auto-grows nested paths and defaults to 256 for indexed list/array growth. Bound constructor nesting, maps, and converted collection sizes separately, and keep self-populating lists such as AutoPopulatingList out of bindable objects: their get(index) creates elements, so a huge index allocates past that limit.
• Validate path, query, header, cookie, form, multipart, and JSON values after conversion, including cross-field and authorization invariants.
• Map routes and HTTP methods explicitly and reject unsupported content types before selecting a converter or allocating large request objects.

Authorization and dispatch behavior

• Authorize the resolved object and transition inside the service transaction; a mapped controller, path variable, or successful converter does not prove ownership.
• Cover REQUEST, ASYNC, ERROR, and FORWARD dispatches in security