In Apache Struts Dynamic Method Invocation (DMI), method: is a request pattern that can direct the framework to call a specific action method instead of the default handler. It is part of Struts’ method-dispatch logic, so it changes how an incoming request is routed on the server.
This matters because any feature that lets client input influence method selection expands the attack surface. In vulnerable or legacy Struts configurations, crafted method: requests can reach unintended code paths and, in affected versions, contribute to remote code execution. Defenders should disable DMI unless it is truly needed, restrict allowed methods, and review logs for unusual method: patterns as a hunting clue. On exposed Java apps, combining version checks with configuration review is the safest way to confirm whether the pattern is dangerous.