title: Unwanted comma-separated arguments to Spring controller method
body: <p>I'm seeing a strange problem with a Spring MVC controller.  This method is intended to set the password.  It takes two form parameters "password" and "confirmPassword".  The first time the form is called, this works fine-- the fields are passed to the method.</p>
  
  <p>The problem occurs when the form is submitted a second time.  If the form is incorrectly filled out the first time, the user is correctly sent back to the form page and prompted to enter the password again.  However the arguments to the method are incorrect on the second try.  The arguments are a comma separated list which includes the first form entry concatenated with the second.</p>
  
  <p>Example:</p>
  
  <p>First form post with field "password" has a value of "abc".  Method argument "password" has value "abc".</p>
  
  <p>Second form post with field "password" and a value of "xyz".  Method argument "password" has value "xyz,abc".</p>
  
  <p>The Spring MVC docs don't indicate much useful.  Somehow the old form post is remembered and included. Anyone have experience in solving this?</p>
  
  <p>Controller method is below:</p>
  
  <pre><code>@RequestMapping(value = "/account/reset", method = RequestMethod.POST)
  public String resetPassword(@RequestParam("password") String password,
          @RequestParam("confirmPassword") String confirmPassword,
          @RequestParam("hash") String hash, ModelMap model) throws EncryptionException
  {
      String userName = stringEncrypterService.decrypt(hash);
      User user = userService.findUserByPath(userName);
  
      if (!password.equals(confirmPassword))
      {
          model.put("hash", hash);
          model.put("user", user);
          model.put("error",
                  "The two passwords you entered below do not match. Please try again.");
  
          return "users/resetPassword";
      }
  
      userService.updatePassword(user, password);
      emailService.sendUserInfoChange(user);
      return "redirect:/session/signin?passwordReset=true";
  }
  </code></pre>
  
  <p>Update.  Several responders have suggested that perhaps the problematic posts have extra URL parameters or hidden form fields resulting in duplicate field names.  I confirmed with Fiddler that this is not the case.  Here's the raw request from the third try. (slightly edited to remove session cookie).</p>
  
  <pre><code>POST http://wintest.foriodev.com/simulate/account/reset/ HTTP/1.1
  Host: wintest.foriodev.com
  Connection: keep-alive
  Referer: http://wintest.foriodev.com/simulate/account/reset/
  Content-Length: 73
  Cache-Control: max-age=0
  Origin: http://wintest.foriodev.com
  User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16
  Content-Type: application/x-www-form-urlencoded
  Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
  Accept-Encoding: gzip,deflate,sdch
  Accept-Language: en-US,en;q=0.8
  Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
  Cookie: AUTOLOGIN_TOKEN=xyz; SIMULATE_WORKER=wintest; JSESSIONID=xyz; 
  
  password=a&amp;hash=xyz&amp;confirmPassword=a&amp;save=Reset+Password
  </code></pre>