RFR: 8272758: Improve HttpServer to avoid partial file name matches while mapping request path to context path [v5]

Volkan Yazici vyazici at openjdk.org
Mon Feb 16 19:27:30 UTC 2026


On Mon, 16 Feb 2026 19:24:00 GMT, Volkan Yazici <vyazici at openjdk.org> wrote:

>> Currently `HttpServer` allows matching a request path `/foobar` to context path `/foo`. Replace this surprising behaviour with a safer approach by requiring exact *path prefix matches*.
>> 
>> 
>>          |           Request path
>>  Context +------+-------+----------+---------
>>   path   | /foo | /foo/ | /foo/bar | /foobar
>> ---------+------+-------+----------+---------
>>  /       |   Y  |   Y   |     Y    |    Y
>>  /foo/   |   N  |   Y   |     Y    |    N
>
> Volkan Yazici has updated the pull request incrementally with one additional commit since the last revision:
> 
>   State that the property is temporary

src/jdk.httpserver/share/classes/module-info.java line 130:

> 128:  *
> 129:  * <p>This property is introduced temporarily to restore the old behavior in
> 130:  * case of need and will be removed in a future release.</p>

@dfuch @Michael-Mc-Mahon I've added the following paragraph to state that the property is temporary. Would you mind sharing your feedback, please? After integrating your feedback, I will issue a 2nd CSR round.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/29264#discussion_r2813782701


More information about the net-dev mailing list