Not encoding '+' in URLs anymore breaks backwards compatibility with apps running on spring 4 [SPR-17474]

[spring-projects-issues]

Jean-Pierre Bergamin opened SPR-17474 and commented

We upgraded some of our apps from spring boot 1.5.x to 2 and therefore to spring 5.x. We now have backward compatibility issues of http clients running with spring 5 and web services running with spring 4 because the + in query params on the client side is not encoded anymore. Services still running with Spring 4.x replace the + now with a space and therefore those query params are now broken on the server side (e.g. with this URL: http://example.com?when=2007-08-31T16:47+02:00). I'm also pretty sure that many other web frameworks besides spring 4 blindly replace a + with a space being in a query param or not and therefore see invalid query params sent from spring 5 clients now. So IMHO the change in behaviour here is dangerous and not really necessary because a + that is encoded with %2b will be properly handled by any web framework.

This change has been introduced here f2e293a because of #19394

 

 

---

Affects: 5.0.10

Issue Links:

• Spring is inconsistent in the encoding/decoding of URLs [SPR-16860] #21399 Spring is inconsistent in the encoding/decoding of URLs ("duplicates")
• Encoding of URI Variables on RestTemplate [SPR-16202] #20750 Encoding of URI Variables on RestTemplate ("duplicates")
• UriComponentBuilder doesn't work with encoded HTTP URL having '+'. [SPR-14828] #19394 UriComponentBuilder doesn't work with encoded HTTP URL having '+'.

[spring-projects-issues]

Jean-Pierre Bergamin commented

Probably a duplicate of #21399

[spring-projects-issues]

Rossen Stoyanchev commented

This has been discussed at great length in #21399 and #20750.

The short story is that "+" should be encoded in some cases and left alone in others. See #19394, #20551, and #14805 for examples of the latter. The reason for the change is explained under #19394 and in the subsequent discussions over the breaking change.

The outcome of all of the above changes and discussions is that we are not going to go back to the way it was before, but we move forward via #21577 to make it possible to get the behavior you want.

As there are a number of ways for URIs to be created in a Spring application, I can't point to a specific answer without more details. Please review the updated "URI Links" in the documentation and the text on "URI Encoding" within that. If you can't' find the answer, please ask.