spring-projects / spring-projects/spring-security
PathPatternRequestMatcher is not a suitable replacement for the deprecated MvcRequestMatcher
@jzheaux is already working on this.
Since Aug 26, 2025.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
Due to the deprecation of MvcRequestMatcher, its replacement 'PathPatternRequestMatcher' requires to know the servlet path(s) beforehand. In my usecase i cannot know this.
To Reproduce
- Have the security chain defined in a seperate autoconfigure module. With a permitAll path.
- Have a servlet path defined in the application that uses the autoconfigure module.
- In the old (mvcrequestmatcher) situation: request /servlet-path/permit-all-path = 200
- In the new (pathpatternrequestmatcher) situation: request /servlet-path/permit-all-path = Err
Expected behavior
Another matcher that can dynamically add the requestMatchers to each registered servlet within the applcation, without requiring me to know the servlet paths beforehand.
Sample
See a sample in this repo: https://github.com/genie137/demo-depr-webmvc-matcher
I have taken the important parts from closed source libraries to reproduce.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.