Spring WebFlux 7.0

Apply the Spring Boot 4.1 and Java 25 prompts first. These rules cover Spring Framework 7.0.9 WebFlux controllers, functional endpoints, codecs, WebClient, sessions, and streaming. The framework retains a Java 17 minimum; these rules target Java 25.

Routing and binding

• Constrain @ModelAttribute and ServerRequest.bind with dedicated input types and WebDataBinder.setDeclarativeBinding(true); explicitly allowlist setter-bound fields with setAllowedFields where needed. These binder settings do not restrict JSON deserialization through @RequestBody.
• Authorize resource and tenant identifiers from the intended input source independently of bound model fields: @ModelAttribute combines form data, query parameters, URI variables, and headers, with form and query values taking precedence over matching URI variables or headers.
• Apply @Valid or @Validated to annotated command objects and explicit constraints to scalar parameters. Check an adjacent Errors or BindingResult before doing work; declaring one can transfer validation-error handling to the controller.
• Handle both WebExchangeBindException and HandlerMethodValidationException; @Valid alone does not activate method validation. Remove class-level @Validated when relying on WebFlux's built-in controller method validation instead of AOP validation.
• Invoke a configured Validator explicitly in functional handlers after bodyToMono or for each bodyToFlux element, before persistence or other side effects; decoding a DTO does not itself enforce its Bean Validation constraints.
• Declare