Fix HTTP Parameter Pollution: Spring Boot REST API Code Review (opens in new tab)

Fix HTTP Parameter Pollution: Spring Boot REST API Code Review A Spring Boot controller binding ?role=user&role=admin to a plain String will quietly take the last value, or the first, depending on the servlet container. That non-determinism is the attack surface. Proxies strip, reorder, or concatenate duplicates differently from Tomcat, so an attacker who knows your stack can craft a request where your WAF sees role=user and your controller sees role=admin. No injection required, just a secon...