Controllers, Mapping & Handler Methods

Put a placeholder in curly braces in the mapping, like /users/{id}, then bind it with @PathVariable on a method parameter. Spring extracts that URL segment and passes it into your method.

@RequestBody reads the raw request body (usually JSON) and deserializes it into an object using a message converter. @ModelAttribute binds request parameters (query string or HTML form fields) onto an object via its setters.

@RequestMapping maps HTTP requests (by URL path and method) to controller methods. @GetMapping, @PostMapping, @PutMapping, @DeleteMapping, and @PatchMapping are shortcuts for @RequestMapping with the HTTP method already fixed (GET, POST, PUT, DELETE, PATCH).

@PathVariable pulls a value out of the URL path itself (e.g. /users/42 -> id=42). @RequestParam reads a query-string parameter after the ? (e.g. /users?id=42) or a form field. You use @PathVariable to identify a resource, @RequestParam to filter/paginate/search.

@Controller returns view names that a template engine renders into HTML. @RestController is @Controller plus @ResponseBody, so every method's return value becomes the HTTP response body (usually JSON) instead of a view name.

RedirectAttributes controls data passed through a redirect. addAttribute puts values in the redirect URL (path/query params, visible). addFlashAttribute stores objects server-side in a flash map that survives exactly one redirect, so they aren't in the URL and can be complex objects.

consumes restricts a handler to requests whose Content-Type matches (what the endpoint accepts in the body). produces restricts by the client's Accept header and sets the response content type. Non-matching requests get 415 (Unsupported Media Type) or 406 (Not Acceptable).

By default @RequestParam is required, so a missing param -> 400. Make it optional with required=false (value is null when absent), or give defaultValue="..." (used when absent, and implies not-required), or declare the type as Optional<T> or a nullable type.

@ModelAttribute binds every request parameter whose name matches a property, so an attacker can add extra params (like admin=true) to set fields the form never exposed. Defend with setAllowedFields/setDisallowedFields in @InitBinder, or bind to a narrow DTO instead of the entity.

Model is an interface for adding named attributes to the view. ModelMap is a Map-based implementation of that idea. ModelAndView bundles the model AND the view name/object together as a return value. Attributes you add become variables the view template can render.

WebMvc.fn is an alternative to @Controller where you define routes in code. A RouterFunction maps a RequestPredicate (like GET /hello) to a HandlerFunction that takes a ServerRequest and returns a ServerResponse.

ServerRequest gives you the body via request.body(Type.class), path variables via pathVariable("id"), and query params via param("q"). ServerResponse is a builder: ServerResponse.ok().body(obj) or ServerResponse.created(uri).build() to set status, headers, and body.

Add a regex after a colon inside the braces: {id:[0-9]+} matches only digits. Spring uses the regex to decide whether the URL matches that segment, so non-matching URLs fall through to other mappings or 404.

WebDataBinder binds request parameters onto a target object and converts their types. An @InitBinder method receives that binder before binding so you can register custom editors/converters, restrict which fields may be bound, mark required fields, or attach a Validator.

params and headers add extra conditions: a handler only matches if the request has the given query parameters / headers. You can require presence ("debug"), absence ("!debug"), or a specific value ("type=admin"). They let two handlers share a path but split on a param or header value.

@RequestHeader binds an HTTP request header (e.g. Accept-Language, Authorization) to a method parameter; @CookieValue binds a single cookie's value by name. Both support required, defaultValue, and type conversion, just like @RequestParam — they only differ in WHERE they read from.

At class level, @ResponseBody applies to every handler method (that's what @RestController does). At method level, it applies only to that one method. So on a plain @Controller you put @ResponseBody on just the JSON methods and leave the rest returning view names.

Implement HandlerMethodArgumentResolver with supportsParameter (usually keyed on a custom annotation or type) and resolveArgument (pull the value from the request). Register it by overriding WebMvcConfigurer.addArgumentResolvers. It runs after the built-in resolvers.

It's the return-side strategy interface. After the method runs, Spring finds the first HandlerMethodReturnValueHandler whose supportsReturnType is true and calls handleReturnValue, which turns the return value into a view, a serialized body, a redirect, etc.

nest() (or path()) groups routes under a shared predicate like /users, so you don't repeat it. Inside a nest you can attach filters that apply only to those routes: filter() wraps the handler, before()/after() transform the request/response, and onError() maps exceptions to responses.

You expose RouterFunction<ServerResponse> beans. Spring's RouterFunctionMapping combines them and the DispatcherServlet dispatches matching requests to them. Annotated controllers use RequestMappingHandlerMapping. Both work together; by default the annotated handler mapping is consulted before the functional one.

? matches exactly one character within a segment. * matches zero or more characters within a single path segment (no slash). ** matches zero or more whole segments and, under PathPattern, must be the last element. You can capture ** with {*name}.

PropertyEditors are the old JavaBeans mechanism: stateful, not thread-safe, registered per binding, only String↔Object. ConversionService (Converter/Formatter) is the modern, stateless, thread-safe, type-to-any-type system registered globally. Prefer the ConversionService.

When several mappings match, Spring picks the most specific one using RequestMappingInfo comparison: exact paths beat path variables beat wildcards, and more predicates (method, params, headers, produces) make a mapping more specific. Truly equal matches throw an ambiguous-mapping error.

For a repeated param (?tag=a&tag=b) bind List<String> or String[]. To grab every query param at once, use @RequestParam Map<String,String> (one value per name) or @RequestParam MultiValueMap<String,String> (preserves all values per name).

@RestController is a composed annotation carrying @Controller (which itself carries @Component) plus @ResponseBody. Spring's component scanning finds @Component transitively through these meta-annotations, so a @RestController class is auto-registered as a bean and recognized as a web handler.

After the handler runs, RequestMappingHandlerAdapter passes the return value to a chain of return-value handlers. If @ResponseBody is present (method or class), RequestResponseBodyMethodProcessor serializes it via HttpMessageConverters. Otherwise it's treated as a view name and resolved by a ViewResolver.

AntPathMatcher parses patterns as strings on every request; PathPatternParser pre-compiles each pattern once into a reusable PathPattern, so matching is much faster. PathPatternParser is the modern default and adds {*name} capture, but restricts ** to the pattern's end.

A HandlerMethodArgumentResolver reads the request's InputStream, picks an HttpMessageConverter that supports the target type and the request's Content-Type, and uses it (e.g. Jackson) to deserialize the body. No match yields 415; a malformed body yields HttpMessageNotReadableException (400).