diff --git a/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java b/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java index 33a32f0088a..58cde851f5b 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java +++ b/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java @@ -93,7 +93,14 @@ public @interface ModelAttribute { * Allows data binding to be disabled directly on an {@code @ModelAttribute} * method parameter or on the attribute returned from an {@code @ModelAttribute} * method, both of which would prevent data binding for that attribute. - *
By default this is set to {@code true} in which case data binding applies. + *
Note: This flag only controls binding via setters and + * direct binding to fields of an existing object. It does not preclude + * constructor binding, which is required to create the object and is safer + * as the constructor declares explicitly the inputs it needs. + * A typical case is where a model attribute is stored in the session, via + * {@link SessionAttributes}, and needs to be accessed again in another + * request later without further binding. + *
By default, this is set to {@code true} in which case data binding applies. * Set this to {@code false} to disable data binding. * @since 4.3 */