Essential Spring Boot 3 Migration Guide: URL Matching, Header Limits, and More

Environment : Spring Boot 3.0.5

1. Spring MVC and WebFlux URL Matching Changes

Starting with Spring Framework 6.0, the trailing‑slash matching option is deprecated and its default value is false. Previously both /some/greeting and /some/greeting/ were matched:

// Before Spring 6
@GetMapping("/some/greeting")
public String greeting() {
    return "Hello";
}
// Only "/some/greeting" matches after Spring 6

To re‑enable trailing‑slash matching you can declare both paths in @GetMapping:

@GetMapping({"/some/greeting", "/some/greeting/"})

Or configure it globally:

// Spring MVC
@Configuration
public class WebConfiguration implements WebMvcConfigurer {
    @Override
    public void configurePathMatch(PathMatchConfigurer configurer) {
        configurer.setUseTrailingSlashMatch(true);
    }
}

// WebFlux
@Configuration
public class WebConfiguration implements WebFluxConfigurer {
    @Override
    public void configurePathMatching(PathMatchConfigurer configurer) {
        configurer.setUseTrailingSlashMatch(true);
    }
}

2. HTTP Header Size Configuration

Before Spring 6 the property server.max-http-header-size behaved inconsistently across embedded servers. It has been deprecated and replaced by server.max-http-request-header-size, which now only controls request header size and is independent of the underlying server.

# Before Spring 6
server:
  max-http-header-size: 8KB

# Spring 6 and later
server:
  max-http-request-header-size: 8KB

To limit the maximum size of HTTP response headers on Tomcat or Jetty, use WebServerFactoryCustomizer:

public class WebConfig implements WebServerFactoryCustomizer<TomcatServletWebServerFactory> {
    @Override
    public void customize(TomcatServletWebServerFactory factory) {
        // custom configuration here
    }
}

Note: Jetty does not yet support Servlet 6.0, so using Jetty with Spring Boot 3 requires downgrading the Servlet API to 5.0 (e.g., jakarta-servlet 5.0).

3. RestTemplate and Apache HttpClient

Spring 6 removes support for Apache HttpClient and replaces it with org.apache.httpcomponents.client5:httpclient5 (different groupId). If you encounter unexpected HTTP client behavior, RestTemplate may fall back to the JDK client, and the old org.apache.httpcomponents:httpclient dependency could be pulled transitively.

4. Actuator Endpoints Cleanup

The /env and /configprops endpoints now mask all values by default, not only sensitive keys. In Spring Boot 2.7 the endpoints showed raw values, while in Spring Boot 3 they encrypt every value.

To display values, configure:

management:
  endpoint:
    env:
      show-values: always
    configprops:
      show-values: always

Custom sanitizing can be provided via a bean:

@Configuration
public class ActuatorConfig {
    @Bean
    SanitizingFunction sanitizingFunction() {
        return data -> data.withValue("------");
    }
}

5. Configuration Changes

Cassandra : property prefix changed from spring.data.cassandra to spring.cassandra.

Redis : property prefix changed from spring.redis to spring.data.redis (requires Spring Data on the classpath).

MySQL JDBC Driver : coordinates changed from mysql:mysql-connector-java to com.mysql:mysql-connector-j. Update your dependency when migrating.

Spring Security : Spring Boot 3 upgrades to Spring Security 6.0.

ReactiveUserDetailsService : No longer auto‑configured when an AuthenticationManagerResolver is present. Define your own bean if needed.

These are the main changes you need to apply when moving a Spring Boot application to version 3.0.