Spring Boot how to use HiddenHttpMethodFilter

Question

As we all know, forms only support GET or POST methods, like this:

<form method="[GET|POST]" action="/user/create">

If our controller has a PUT mapping, we get a 405 error, which means we can only use GET or POST but not PUT.

public class UserController {

    @Autowired
    private UserService userService;

    @RequestMapping(value = "/create", method = RequestMethod.PUT)
    public ModelAndView createUser(@ModelAttribute("user") Users user, BindingResult bindingResult){
        ModelAndView mv = new ModelAndView("list");
        // do something...
        return mv;
    }
}

In spring MVC, we can solve this problem:

First, create a hidden field like this:

<form method="[GET|POST]" action="/user/create">
    <input type="hidden" name="_method" value="put"/>

Second, add a filter

<filter>  
    <filter-name>HiddenHttpMethodFilter</filter-name>  
    <filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>  
</filter>  

<filter-mapping>  
    <filter-name>HiddenHttpMethodFilter</filter-name>  
    <servlet-name>springmvc</servlet-name>  
</filter-mapping>     

In this way, we can use the PUT method.

But how can I do it in Spring Boot? I know Spring Boot have a class named WebMvcAutoConfiguration which owns a method hiddenHttpMethodFilter, but how can I use the class?

Nardoo

You shouldn't need to do anything as Spring Boot will automatically configure the hidden http method filter for you – Etheridge

@AndyWilkinson thanks a lot man. I edit my question, But if I do not configure the hidden http method filter, how can I use a put submit in html form. – Nardoo

Like you normally would. Just put the element in the form... – Vlissingen

Since Spring Boot 2.2, the filter is no longer automatically configured. Set spring.mvc.hiddenmethod.filter.enabled=true in your application.properties to enable it again. – Mertz

Note that using HiddenHttpMethodFilter opens your application to a whole bunch of new CSRF attacks. Be sure you have other means of blocking requests from external forms. And no, CORS does not work for forms. – Thomasinathomasine

Answer 1

Add the following to your application.properties file:

spring.mvc.hiddenmethod.filter.enabled=true

This will automatically configure the HiddenHttpMethodFilter class.

Next, use th:method="DELETE" on the form to have Thymeleaf add the hidden field automatically.

Note

• For Spring Boot < 2.2 always registers the filter
• For Spring Boot 2.2 or higher you need to set the property

Mertz

[Updated]@Deblauwe. I use Sping boot 2.7.0. I put in the form th:method="delete", and atDeleteMapping, and the : "spring.mvc.hiddenmethod.filter.enabled=true" in application.yaml, and it does not work. It says about "Request method post not supported". Any idea please? It is not supported in newest Spring boot versions. Thanks in advance – Skepticism

@Skepticism please ask a separate question for this. – Mertz

Hello @Deblauwe sir. Thanks for the reply. I used the atBean FilterRegistrationBean, I saw in the next reply. For me, my spring boot did not to create it for me, using the yaml property you mentioned. But, I will make this comment a separate question as you told me, so, you can help me, and the thymeleaf community. I will do it in the next 2 hours (I am in work right now) – Skepticism

@Deblauwe - Hello sir. I made this question as you adviced me: "stackoverflow.com/questions/72744349/…". Your experience in this topic will be valuable to me. Thanks in advance – Skepticism

Answer 2

I had dealt with this problem not long ago. You only need to and a Bean under anyone @Configuration class. Such as:

Then, you could use delete request on form. Such as:

Pestle

If you use Spring Boot, add spring.mvc.hiddenmethod.filter.enabled=true to your application.properties to avoid the manual bean configuration. If you use Thymeleaf for the templates, you can use th:method="DELETE" to have Thymelaf add the hidden field automatically. – Mertz

@WimDeblauwe your comment deserves more upvotes, worked for me! – Harold

Turned it into a separate answer now for easier upvoting :) – Mertz

Answer 3

Addition to Wim Deblauwe answer. If you use application.yml, you need to add: spring:mvc:hiddenmethod:filter:enabled: true

Cloris

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. – Hadria