@SessionAttributes not populated when going directly to POST and redirecting while ignoreDefaultModelOnRedirect=true [SPR-12542]

[spring-projects-issues]

Oliver Drotbohm opened SPR-12542 and commented

I have a controller annotated with @SessionAttributes("cart") and q request handling method like this:

@RequestMapping(value = "/cart", method = RequestMethod.POST)
public String addToCart(@RequestParam("product") Long productId,  @ModelAttribute Cart cart) {

   …
   return "redirect:…";
}

If the call to that controller method is the very first one made to that controller in the session, the Cart object is created by an @ModelAttribute annotated method and handed to the method execution. The cart is then not added to the session attributes if ignoreDefaultModelOnRedirect=true as ModelFactory.updateModel(…) looks up the Model from the ModelAndViewContainer which returns the redirect model for a redirect view.

Once you issue a request to a controller method not returning a redirect view, the cart is added to the session and looked up from it for the invocation of the method above. Thus subsequent modifications of the object transparently end up in the session.

We should make sure the default model is used to populate the session attributes independently from the view type that is returned.

---

Affects: 4.0.8, 4.1.3

Issue Links:

• ModelAndView is replaced when a RedirectView is used [SPR-14045] #18617 ModelAndView is replaced when a RedirectView is used

Referenced from: commits ea05e0b

[spring-projects-issues]

Rossen Stoyanchev commented

Right, we should make sure that attributes from the default model that are listed in @SessionAttributes are stored in the session regardless of whether we switch to a redirect model or not.

[spring-projects-issues]

Rossen Stoyanchev commented

Could there be a valid scenario for the current behavior? For example a controller method serving a GET request to serve a form editing page. Perhaps under some circumstances this method would redirect elsewhere because there is some reason why the edit can't be performed (e.g. time of the day, or some other reason). An argument could be made that in that case the form object should not be saved in the session especially if ignoreDefaultModelOnRedirect=true. In the very least it I can see a potential regression if an application depends on the current behavior.

[spring-projects-issues]

Rossen Stoyanchev commented

On some further thought, the "redirect" model was never meant for anything more than helping to construct the redirect URL vs rendering a template. For this reason RedirectAttribute immediately formats attributes as Strings (using converters) to make them suitable for insertion as URI vars or to be appended as query params. Alternatively RedirectAttributes also allows adding flash attributes to save typed objects across the redirect. Or for longer storage than that, @SessionAttributes or the session (directly) can be used.

So given this I think @SessionAttributes should always store attributes from default model regardless if there is a redirect or not, or what the setting of ignoreDefaultModelOnRedirect is. It needs to be simple and predictable.