Spring Web MVC: no request body possible for HTTP DELETE anymore

Question

I have a question for the developers of Spring Web MVC.

In a nutshell: previously it was possible to send a request body in an HTTP DELETE message, but now it is not possible anymore. Why?

In detail:

We are using spring-webmvc-4.2.4.RELEASE.

@RestController
public class Controller {

    @RequestMapping(value = "/{pathVariable}/deleteAnything", method = RequestMethod.DELETE)
    public ResponseEntity<?> deleteAnything(@PathVariable String pathVariable,
        @Valid @RequestBody Set<Pojo> pojoSet) {
        ...

We send

DELETE /anything/deleteAnything HTTP/1.1
Content-Type: application/json
Host: example.com

[ {
  "any field" : "Any value"
} ]

and get the exception

m.m.a.RequestResponseBodyMethodProcessor : Read [java.util.Set<packagename.Pojo>] as "application/json;charset=UTF-8" with [org.springframework.http.converter.json.MappingJackson2HttpMessageConverter@333825a3]
.w.s.m.m.a.ServletInvocableHandlerMethod : Error resolving argument [1] [type=java.util.Set]
HandlerMethod details: 
Controller [packagename.Controller]
Method [public org.springframework.http.ResponseEntity<?> packagename.Controller.deleteAnything(java.lang.String,java.util.Set<packagename.Pojo>)]


org.springframework.http.converter.HttpMessageNotReadableException: Required request body is missing: public org.springframework.http.ResponseEntity<?> packagename.Controller.deleteAnything(java.lang.String,java.util.Set<packagename.Pojo>)
    at org.springframework.web.servlet.mvc.method.annotation.RequestResponseBodyMethodProcessor.readWithMessageConverters(RequestResponseBodyMethodProcessor.java:151)
    at org.springframework.web.servlet.mvc.method.annotation.RequestResponseBodyMethodProcessor.resolveArgument(RequestResponseBodyMethodProcessor.java:125)
    ...

It seems that the request body has been removed.

If we use HTTP POST instead of HTTP DELETE everywhere, it works fine.

Previously it worked fine (sorry that I cannot specify previously because our dependencies are very complicated. If it helps you, I can post an old build.gradle).

Why is it not possible anymore?

@Ralph: we changed nothing. In our `build.gradle` we have dependencies like `compile 'org.springframework.security:spring-security-web:4.0.+'`, so perhaps any dependency has been updated automatically by gradle. — Johannes Flügel, Feb 25 '16 at 08:10
@shazin I send the request via Postman. But via `org.springframework.web.client.RestTemplate` it does not work, neither. — Johannes Flügel, Feb 25 '16 at 10:03

score 7 · Answer 1 · edited Oct 07 '21 at 05:51

You probably should redesign your API, as payloads within DELETE requests should be ignored.

From https://www.rfc-editor.org/rfc/rfc7231#section-4.3.5:

A payload within a DELETE request message has no defined semantics.

From https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.3:

If the request method does not include defined semantics for an entity-body, then the message-body SHOULD be ignored when handling the request.

score 1 · Accepted Answer · answered Feb 26 '16 at 09:04

1

It seems to be a problem with zuul. Without zuul it works. Spring has nothing to do with it.

answered Feb 26 '16 at 09:04

Johannes Flügel

3,112
3
17
32

1

There is an issue logged for spring-cloud-netflix for DELETE request body being ignored: https://github.com/spring-cloud/spring-cloud-netflix/issues/949 – jett Aug 21 '16 at 10:07

Spring Web MVC: no request body possible for HTTP DELETE anymore

2 Answers2