RequestParam with special character '+'

Question

in my Controller I have the requestMapping "searchUser" with 4 request parameters. For the request parameter "phoneNumber" I also accept special characters like '(' , ')', '-' and '+'.

Expect of the character '+' all characters are shown in my log. If I send for example the values like "+123" or "123+1" I get i my controller " 123" and "123 1" It replaces the "+" with a space.

It only happens with '+'

@RequestMapping(method = RequestMethod.GET, value = "/search", produces = "application/json")
    public List<User> getWebUserProfiles(HttpServletRequest request, HttpServletResponse response,
        @RequestParam("firstName") String firstName, @RequestParam("lastName") String lastName,
        @RequestParam("email") String email
        @RequestParam("phoneNumber") String phoneNumber);

Do you know what I have to add?

thanks in advance!

UPDATE:

I using Angular 2 for my frontend where I have a form and I send the values further to my spring-boot backend. My http-service in angular:

   search(searchParams: any){
        let params = new URLSearchParams();
        params.set('firstName', searchParams.firstName);
        params.set('lastName', searchParams.lastName);
        params.set('email', searchParams.email);
        params.set('phoneNumber', searchParams.phoneNumber);

        return this._http.get(this.baseURL+'search', 
                        { search:params })
                        .map(response => response.json())
                        .catch(this.handleError);
    }

Solution 1

Ok I solved it.

I encoded it in my fronted. There were no other options.

params.set('phoneNumber', encodeURIComponent(searchParams.phoneNumber));

Thank you to for your help!

Solution 2

You can simply replace any instance of '+' with '%2B' on the javascript end before sending it to server.

Reference here

Comments

[Tomato]

You should ensure that your front end URI-encodes all fields. Either by coding it individually, or by ensuring that your framework takes care of it. Otherwise the user will get surprises e.g. if they put an & into a text field.

[kan]

It doesn't look right. The angular.io/docs/ts/latest/api/http/index/… says it is already doing encoding by default. So, apparently something else is doing something wrong - could be a server side decoding it twice or something. Try to see raw traffic and find out where do you have "+" or " ".

[trap]

@slim Thanks for the advice.

[trap]

@kan Really? In my case it actually does not do it. In my spring-boot backend I encode everthing and give it to the next controller. I also tried to set the content-type: 'application/x-www-form-urlencoded'. But it does not work

[kan]

I bet spring-boot does all encoding/decoding magic behind the scenes already. What exactly are you encoding in spring-boot and why?