Make RedirectViews use RESPONSE_STATUS_ATTRIBUTE as a response status if defined [SPR-13208]

[spring-projects-issues]

Brian Clozel opened SPR-13208 and commented

With #16413, many defaults regarding HTTP caching policies have been updated to the latest standards.

By default, RedirectViews have http10Compatible set to true, which means that they use HTTP 302 as a default HTTP response status. Setting this property to false make RedirectViews use HTTP 303 by default.

Now when set to false, RedirectViews don't use the RESPONSE_STATUS_ATTRIBUTE request attribute as a response HTTP if it is available. Both configuration choices should behave the same regarding to this request attribute.

---

Affects: 4.1.7

Reference URL: https://jira.spring.io/browse/SPR-13197?focusedCommentId=117313&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-117313

Issue Links:

• Support @ResponseStatus with RedirectView [SPR-13197] #17789 Support @ResponseStatus with RedirectView

Referenced from: commits 8e56602

[spring-projects-issues]

Brian Clozel commented

Hey Arjen Poutsma, Rossen Stoyanchev, Sébastien Deleuze

I've looked at this and this actually bothers me.
I've tried just changing the default value in this draft commit.

I'm fine with always making use of the redirect attribute, which is the main driver fir this issue, as explained in #17789.

But as explained in the draft commit, changing this default value also changes the default HTTP status used for redirection.
Instead of using HTTP 302 Found, HTTP 303 See Other is used. I think this status has been chosen because HTTP clients tend to rewrite the method, which is not supposed to be the case with 301/302:

• POST /resource -> HTTP 303 Location /other -> GET /other

But as stated in the latest HTTP RFC, they've accepted this common behavior now as a de facto standard. And most frameworks and clients do that too.

So here's my proposal:

1. Make sure that we use the RESPONSE_STATUS_ATTRIBUTE in all cases (I don't know why it's not the case already)
2. Deprecate http10Compatible and leave its default value
3. Removing it in the future, leaving 302 as the default redirect status for HTTP 1.1+

[spring-projects-issues]

Brian Clozel commented

I've updated the issue description and for now I'll go with just the request attribute support.
Nowadays, 302 and 303 behave the same and are both accepted by the latest RFCs. There's no need to deprecate this right now.