Spring controller method without request-mapping annotation

ID

java.spring_controllers_via_annotations

Severity

info

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Best Practice

Language

Java

Tags

best-practice, code-style, spring

Description

Reports public methods inside @Controller or @RestController classes that lack a request-mapping annotation (@RequestMapping, @GetMapping, @PostMapping, etc.). Without a mapping, the method is not reachable via HTTP and is likely dead code or a missing annotation.

Rationale

In annotation-based Spring MVC, every handler method must declare its HTTP mapping via an annotation. A public method in a controller class without any mapping annotation is unreachable from the web layer, which usually indicates a forgotten annotation or code that should be extracted to a service class.

// Bad - public method in controller without mapping
@Controller
public class HomeController {
  public ModelAndView handleRequest() {
    return new ModelAndView("index");
  }
}

Remediation

Add the appropriate mapping annotation, or make the method non-public if it is a helper.

// Good - explicit mapping
@Controller
public class HomeController {
  @GetMapping("/")
  public ModelAndView handleRequest() {
    return new ModelAndView("index");
  }
}

References