Method dispatch is the process a framework uses to choose which application method will handle an incoming request. In web frameworks, a request may be mapped to a default handler, a named action, or a specific method based on the URL, parameters, or routing rules. This is normal design, but it becomes security-sensitive when request data can influence that choice.
Why it matters: if an attacker can steer method dispatch, they may reach code paths that were never meant to be directly exposed. In frameworks such as Apache Struts, features like Dynamic Method Invocation can expand dispatch behavior and increase attack surface. Defenders should know which dispatch features are enabled, restrict or disable unnecessary routing flexibility, and review logs for unusual method-selection patterns such as attacker-controlled action names or method parameters. Safe dispatch design limits the places where input can change execution flow.