Home Search Pricing Get inErrata About

Sign in Sign up

Graph/spring-mvc-routing-misconfig

AntiPattern

Spring MVC Routing Misconfig

spring-mvc-routing-misconfig

Endpoint routing fails after migrations because request mapping, matchers, and management base paths remain on defaults or are applied inconsistently, so redirects/forwards and exception handling don’t trigger and the app silently serves the wrong behavior.

Node Details

Public graph metadata

Updated7/11/2026

Connections

30 linked nodes

MATCHESSolution

Configure Next.js middleware to match /api/:path* so requests can be tracked and routed consistently

MATCHESSolution

Handle authentication/401 redirects via TanStack Router route guards (e.g., use beforeLoad in an authenticated parent route and throw redirect({ to: '/login' })) so the router performs the redirect as part of its normal route resolution and triggers the correct re-render.

MATCHESSolution

use hash-based routing — react + tanstack router + github pages. Tension: The default "browser" routing will exhibit the behaviour you describe.

MATCHESSolution

Set redirect_slashes=False and add both "" and "/" route decorators so both /api/users and /api/users/ work reliably

MATCHESSolution

After changing the route name to all lowercase (`sign-in`) in the main branch and redeploying — the route name in the code was `sign-in`, but on GitHub, I had accidentally pushed it as `Sign-in`. Tension: Since Next.js is case-sensitive with routes, this mismatch caused the deployed version on Vercel to fail. Outcome: everything started working fine.

MATCHESSolution

Upgrade Angular to a version where the CommonEngine bug is fixed, and switch SSR rendering to use AngularNodeAppEngine with server-side routing enabled (instead of CommonEngine). Configure the server routing/app engine accordingly so parameterized routes resolve on direct requests.

MATCHESSolution

We can fix this by giving a default response like this: — app/api/test/route.ts. Tension: No response is returned from route handler. Outcome: return NextResponse.json({data: "Uh oh! Resource Not Found"}, {status: 404}).

MATCHESSolution

Clear the cookies and test it — on another browser. Tension: private routes all redirect to the home page. Outcome: it went trough just fine.

MATCHESSolution

Fix the imports to consistently reference the same module path (e.g., remove the `src.` prefix or otherwise ensure identical import paths for the `Document` model used during initialization and in route handlers).

MATCHESSolution

Consider using custom APIRoute instead. — It's quite similar to middleware in functionality, but it's called after the routing. Tension: there is no easy way to get this information. Outcome: app.router.route_class = LoggingRouter.

MATCHESSolution

Use route.matches(request.scope) on request.app.routes before call_next() and return route.path when Match.FULL

MATCHESSolution

Do not rely on parent-app `@app.middleware` for sub-application isolation; instead apply middleware to the subapi directly, or add conditional logic in the middleware (e.g., check request path/prefix like `/subapi`) to bypass handling for mounted routes.

MATCHESSolution

Remove the trailing slash from the request URL (ensure the endpoint path matches what Postman uses) so the server no longer returns a 307 redirect.

MATCHESSolution

Update the checkout router to mount the POST handler at the base path by changing router.post('/checkout', ...) to router.post('/', ...) (or otherwise align the router mount path and handler path so the final route is /api/checkout).

MATCHESSolution

Follow the v4.x API for route handling and hooks instead of importing handleAuth; configure authentication via the provided Auth0Client/server setup (e.g., implement the relevant callback such as beforeSessionSaved) and use the correct route handler pattern per the latest documentation.

MATCHESSolution

not redirect if the URL is already `/admin/main/users` — if ( adminconfig?.matcher.includes(pathname) || pathname.startsWith("/admin/") ) {.

MATCHESSolution

Add "/support-us" to the middleware matcher array

MATCHESSolution

The default is: /actuator/** — you have to set management.endpoints.web.base-path. Tension: you have not configured the management prefix URL. Outcome: according to the documentation.

MATCHESSolution

You need to tell Spring Security to ignore resources under src/main/resources/static. — adding `http.authorizeRequests((requests) -> requests. .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()) ` to your security config. Tension: remove all the `"/static/...` references from your existing configuration. Outcome: adding `http.authorizeRequests((requests) -> requests. .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()) `.

MATCHESSolution

Refactor the configuration to define a @Bean SecurityFilterChain (and relevant Authentication setup) instead of extending WebSecurityConfigurerAdapter, using the current HttpSecurity DSL such as authorizeHttpRequests with requestMatchers and anyRequest().authenticated(), plus formLogin/logout configuration.

MATCHESSolution

For each MvcRequestMatcher, call MvcRequestMatcher#setServletPath to indicate the servlet path. Tension: This method cannot decide whether these patterns are Spring MVC patterns or not. Outcome: For each MvcRequestMatcher, call MvcRequestMatcher#setServletPath to indicate the servlet path.

MATCHESSolution

Verify and use the correct localhost port for the application so the request is processed by the intended Spring Security configuration.

MATCHESSolution

POST /api/v1/admin/graph/cleanup returned 404 — behind the existing admin-secret middleware. Tension: The service rejects broad prefixes and only permits demo-scoped prefixes. Outcome: added a narrowly scoped cleanup service that validates the source prefix against a demo-only pattern, added tests for dry-run/delete behavior, and wired the route through the existing admin middleware.

MATCHESSolution

You should be using relative paths. — render a set of "common" routes both under the root `"/"` path and also under the `"/admin"` path. Tension: This will allow you to move a route around anywhere and it will always match relative to its parent route.

MATCHESSolution

Use the correct route mounting and handler path so GET /api/weather is matched before the unknown-endpoint middleware

MATCHESSolution

You need to define a `WebMvcConfigurer` that forwards all non-static paths. Tension: This is how single-page applications like Angular handle frontend routing.

MATCHESSolution

Configure Spring Security to ignore (bypass) the swagger-ui and api-docs endpoints by adding matching paths (e.g., /swagger-ui/** and /v3/api-docs/**, plus /swagger-ui.html) via a WebSecurityCustomizer (or equivalent permitAll configuration) so the documentation endpoints are accessible.

MATCHESSolution

for custom JPA configuration. Outcome: Modify to this:.

MATCHESSolution

calls requesting the Provider afterwards do not work (the user returns null — after a Spring 5 -> 6 (Spring Boot 3.3.4) migration. Tension: I can sign in to my site, but calls requesting the Provider afterwards do not work. Outcome: I fixed this today, and found the following out that helped resolve this in my custom filter code.

MATCHESSolution

redirect-uri: "https://localhost:41448/redirect-uri" — Here’s my application.yml configuration:.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata