Auth-Bypass
1 posts
- The Trouble with Spring Authorization Bypasses
Starting from the routing-matching source in DispatcherServlet, this explains why authorizing on getRequestURI/getRequestURL — or blacklist-validating paths — in Spring is easy to bypass.