多次使用HttpServletRequest并在方法之间链接

Question

我必须多次阅读 HttpServletRequest。我已经像那些帖子Http Servlet request lose params from POST body after read it once中所说的那样包装了HttpServletRequest@

在我扩展 AbstractAuthenticationProcessingFilter 的过滤器类中，我可以在successfulAuthentication 方法中使用和链接请求，因为它具有链参数。但除了这些解决方案之外，我还必须在尝试和成功的身份验证步骤之间链接请求：

public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException {
            // wrapping request and consuming
        }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        // Since i couldn't chain wrapped httpServletRequest from attemptAuthentication step, this request still gets non-wrapping one and  inputstream is empty
    }

如何将包装的请求从尝试身份验证传递到成功身份验证？

Answer 1

这是一个老问题，但万一有人遇到同样的问题：

您可以像上一个答案中建议的那样包装请求，但您需要在它被身份验证过滤器过滤之前包装它：

Spring 安全配置如下所示：

@Override
    protected void configure(HttpSecurity http) throws Exception {
        AuthFilter authFilter = new AuthFilter();
        WrapperFilter wrapperFilter = new WrapperFilter();
        http    .cors()
                .and()
                .csrf().disable()
                .exceptionHandling().authenticationEntryPoint(exceptionHandler)
                .and()
                .authorizeRequests()
                .antMatchers("/v1/*", "/api/*")
                .authenticated()
                .and()
                .addFilterBefore(authFilter, BasicAuthenticationFilter.class)
                .addFilterBefore(wrapperFilter, AuthFilter.class);
    }

所以包装过滤器在您的身份验证过滤器和包装过滤器的 doFilter 包装请求并将其传递之前：

@Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        MultiReadHttpServletRequest wrapper = new MultiReadHttpServletRequest((HttpServletRequest) request);
        chain.doFilter(wrapper, response);
    }

而MultiReadHttpServletRequest如下：

public class MultiReadHttpServletRequest extends HttpServletRequestWrapper {

    private byte[] body;

    public MultiReadHttpServletRequest(HttpServletRequest request) {
        super(request);
        try {
            body = IOUtils.toByteArray(request.getInputStream());
        } catch (IOException ex) {
            body = new byte[0];
        }
    }

    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(getInputStream(), getCharacterEncoding()));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        return new ServletInputStream() {
            ByteArrayInputStream wrapperStream = new ByteArrayInputStream(body);

            @Override
            public boolean isFinished() {
                return false;
            }

            @Override
            public boolean isReady() {
                return false;
            }

            @Override
            public void setReadListener(ReadListener readListener) {

            }

            @Override
            public int read() throws IOException {
                return wrapperStream.read();
            }
        };
    }
}

Answer 2

没有这样的方法。您唯一能做的就是在每次读取请求时将其包装在一个过滤器中。只需在每次阅读复制正文之前包装请求即可。

查看包装器的一些工作代码，例如here