Spring MVC 7.0

Apply the Spring Boot 4.1 baseline first. These rules cover Spring Framework MVC 7.0.9.

Routing and binding

• Bind request data to dedicated command objects, not persistence entities, keeping tenant and approval-state fields, as well as the baseline's server-owned fields, out of the writable model.
• Use WebDataBinder.setAllowedFields and setDeclarativeBinding(true) for explicit property binding, and @ModelAttribute(binding=false) when an existing object must not be rebound.
• Cap request parameter counts and collection sizes before binding, alongside the Spring Framework auto-growth limits.
• Validate path, query, header, cookie, form, multipart, and JSON values after conversion, including cross-field and authorization invariants.
• Reject BindingResult or Errors failures before business logic; an adjacent error argument lets the controller run with that argument's validation errors.
• Constrain @RequestBody deserialization through its HttpMessageConverter and DTO; WebDataBinder allowed fields do not filter JSON or XML properties.
• Map routes and HTTP methods explicitly and reject unsupported content types before selecting a converter or allocating large request objects.

Authorization and dispatch behavior

• Authorize the resolved object and transition inside the service transaction; a mapped controller, path variable, or successful converter does not prove ownership.
• Cover REQUEST, ASYNC, ERROR, and FORWARD dispatches in security-filter registration and security rules so an error page, forward, or resumed async request cannot bypass