镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

Ignore If-Modified-Since unless method is GET or HEAD - #37579

Open
CCCLL wants to merge 1 commit into
spring-projects:mainfrom
CCCLL:fix/ignore-if-modified-since-unsafe-methods
Open

CCCLL wants to merge 1 commit into
spring-projects:mainfrom
CCCLL:fix/ignore-if-modified-since-unsafe-methods

Conversation

@CCCLL

@CCCLL CCCLL commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

checkNotModified() in ServletWebRequest and
DefaultServerWebExchange evaluates If-Modified-Since for any HTTP
method. For a PUT, POST or DELETE request whose
If-Modified-Since date is not before the last modification date, the
request is considered not modified, and since the method is not safe,
the response status is set to 412:

PUT /resource
If-Modified-Since: Thu, 01 Jan 2026 00:00:00 GMT

With a last modification date of 2026-01-01T00:00:00Z,
checkNotModified(lastModified) returns true and sets the status to
412 (with this change, it returns false and the request proceeds). The
request is rejected precisely when the resource has not changed since
the given date.

RFC 9110, section 13.1.3
requires a recipient to ignore the If-Modified-Since header field "if
the request method is neither GET nor HEAD", and step 4 of the
precedence rules in
section 13.2.2,
which both implementations follow, only evaluates it for GET and HEAD.
This change applies that restriction in both implementations.

If-Match and If-Unmodified-Since, which are the preconditions meant
for conditional POST, PUT and DELETE requests, are not affected,
and neither is If-Modified-Since for GET and HEAD.

New tests in ServletWebRequestHttpMethodsTests (for POST, PUT and
DELETE) and DefaultServerWebExchangeCheckNotModifiedTests fail
without the change and pass with it.
./gradlew :spring-web:check :spring-webmvc:check :spring-webflux:check
passes on JDK 25.

This behavior predates the conditional request revision in gh-24881,
and the code is the same on 7.0.x.

Prior to this commit, checkNotModified in ServletWebRequest and
DefaultServerWebExchange evaluated the If-Modified-Since precondition
for any HTTP method. For a PUT, POST or DELETE request with an
If-Modified-Since date that is not before the last modification date,
the request was therefore considered not modified and the response
status was set to 412 (Precondition Failed), rejecting a request for a
resource that had not changed.

As specified in RFC 9110, section 13.1.3, a recipient must ignore the
If-Modified-Since header field if the request method is neither GET
nor HEAD, and the precedence rules in section 13.2.2 only evaluate it
for GET and HEAD requests. This commit applies that restriction in
both implementations.

Signed-off-by: Jialin Chen <cccll2019@gmail.com>
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Oct 24, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting-for-triage An issue we've not yet triaged or decided on

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants