Spring Boot自定义JsonPostMapping注解失效：接口可被GET请求调用

问题根源 #

你在自定义注解JsonPostMapping中，给method属性添加了@AliasFor(annotation = RequestMapping.class, attribute = "method")，并且默认值是空数组。这会覆盖父注解@RequestMapping里指定的method = RequestMethod.POST配置——当控制器中使用@JsonPostMapping时没显式指定method，Spring会用这个空数组，等同于允许所有HTTP请求方法（包括GET）。

修复方案 #

有两种可行的解决方式：

方式一：修改method属性默认值 #

把JsonPostMapping里method属性的默认值设为RequestMethod.POST，这样即使不手动指定，也会强制限制请求方法为POST：

@Retention(RUNTIME)
@Target(METHOD)
@RequestMapping(consumes = { MediaType.APPLICATION_JSON_VALUE }, produces = {
        MediaType.APPLICATION_JSON_VALUE }, method = RequestMethod.POST)
public @interface JsonPostMapping {
    @AliasFor(annotation = RequestMapping.class, attribute = "value")
    String[] value() default {};

    // 修改默认值为POST
    @AliasFor(annotation = RequestMapping.class, attribute = "method")
    RequestMethod[] method() default {RequestMethod.POST};

    @AliasFor(annotation = RequestMapping.class, attribute = "params")
    String[] params() default {};

    @AliasFor(annotation = RequestMapping.class, attribute = "headers")
    String[] headers() default {};

    @AliasFor(annotation = RequestMapping.class, attribute = "consumes")
    String[] consumes() default {};

    @AliasFor(annotation = RequestMapping.class, attribute = "produces")
    String[] produces() default {};
}

方式二：移除method属性定义 #

如果不需要开放修改请求方法的权限，直接删掉JsonPostMapping里的method属性，这样会直接继承@RequestMapping中method = RequestMethod.POST的配置，代码更简洁：

@Retention(RUNTIME)
@Target(METHOD)
@RequestMapping(consumes = { MediaType.APPLICATION_JSON_VALUE }, produces = {
        MediaType.APPLICATION_JSON_VALUE }, method = RequestMethod.POST)
public @interface JsonPostMapping {
    @AliasFor(annotation = RequestMapping.class, attribute = "value")
    String[] value() default {};

    @AliasFor(annotation = RequestMapping.class, attribute = "params")
    String[] params() default {};

    @AliasFor(annotation = RequestMapping.class, attribute = "headers")
    String[] headers() default {};

    @AliasFor(annotation = RequestMapping.class, attribute = "consumes")
    String[] consumes() default {};

    @AliasFor(annotation = RequestMapping.class, attribute = "produces")
    String[] produces() default {};
}

验证效果 #

修改后重启应用，用GET请求访问/hello会返回405 Method Not Allowed，只有POST请求能正常返回结果，符合预期。

内容的提问来源于stack exchange，提问作者Luke