The equals and hashCode implementation of PathPatternRequestMatcher was altered in https://github.com/spring-projects/spring-security/pull/17337

The current implementation of PathPatternRequestMatcher has a non-final field RequestMatcher method. A setter is present for this field and is used in the Builder.

It seems like a bad practice to use non-final fields inside the equals and hashCode implementation.

I suggest improving this: https://github.com/codingtim/spring-security/commit/2b5df1ceb22291160f246a0275ee48cd8f93282a

Comment From: jzheaux

Sounds great, @codingtim, and good catch. Are you able to submit this as a PR?