From cd0c26b6db8c40847bc9eac4f4d8a2720c3c6a02 Mon Sep 17 00:00:00 2001 From: rstoyanchev Date: Mon, 9 Mar 2026 14:25:47 +0000 Subject: [PATCH] Update Javadoc on binding flag in ModelAttribute Add clarification and mention primary use case. --- .../web/bind/annotation/ModelAttribute.java | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java b/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java index 33a32f0088a..58cde851f5b 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java +++ b/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java @@ -93,7 +93,14 @@ public @interface ModelAttribute { * Allows data binding to be disabled directly on an {@code @ModelAttribute} * method parameter or on the attribute returned from an {@code @ModelAttribute} * method, both of which would prevent data binding for that attribute. - *

By default this is set to {@code true} in which case data binding applies. + *

Note: This flag only controls binding via setters and + * direct binding to fields of an existing object. It does not preclude + * constructor binding, which is required to create the object and is safer + * as the constructor declares explicitly the inputs it needs. + * A typical case is where a model attribute is stored in the session, via + * {@link SessionAttributes}, and needs to be accessed again in another + * request later without further binding. + *

By default, this is set to {@code true} in which case data binding applies. * Set this to {@code false} to disable data binding. * @since 4.3 */