多次使用HttpServletRequest并在方法之间链接

Question

我必须多次阅读HttpServletRequest。我已经像在那些帖子中所说的那样包装了HttpServletRequest Http Servlet请求在阅读一次后从帖子正文中丢失了参数

在我扩展AbstractAuthentiationProcessingFilter的过滤器类中，我可以在成功身份验证方法中消耗和链接请求，因为它具有链参数。但除了这些解决方案之外，我还必须在尝试和成功的身份验证步骤之间链接请求：

public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException {
            // wrapping request and consuming
        }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        // Since i couldn't chain wrapped httpServletRequest from attemptAuthentication step, this request still gets non-wrapping one and  inputstream is empty
    }

如何将包装好的请求从attemptAuthentication传递到successfulAuthentication？

Answer 1

没有这样的方法。你唯一能做的就是每次阅读请求时都将其包装在一个过滤器中。每次阅读请求复制正文之前都包装好它。

查看包装器的一些工作代码，例如

Answer 2

这是一个老问题，但如果有人遇到同样的问题：

您可以像上一个答案中建议的那样包装请求，但需要在通过身份验证过滤器过滤之前包装它：

Spring Security配置如下所示：

@Override
    protected void configure(HttpSecurity http) throws Exception {
        AuthFilter authFilter = new AuthFilter();
        WrapperFilter wrapperFilter = new WrapperFilter();
        http    .cors()
                .and()
                .csrf().disable()
                .exceptionHandling().authenticationEntryPoint(exceptionHandler)
                .and()
                .authorizeRequests()
                .antMatchers("/v1/*", "/api/*")
                .authenticated()
                .and()
                .addFilterBefore(authFilter, BasicAuthenticationFilter.class)
                .addFilterBefore(wrapperFilter, AuthFilter.class);
    }

因此，包装过滤器在您的身份验证过滤器和包装过滤器的doFilter包装请求并将其传递之前：

@Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        MultiReadHttpServletRequest wrapper = new MultiReadHttpServletRequest((HttpServletRequest) request);
        chain.doFilter(wrapper, response);
    }

MultiReadHttpServletRequest如下所示：

public class MultiReadHttpServletRequest extends HttpServletRequestWrapper {

    private byte[] body;

    public MultiReadHttpServletRequest(HttpServletRequest request) {
        super(request);
        try {
            body = IOUtils.toByteArray(request.getInputStream());
        } catch (IOException ex) {
            body = new byte[0];
        }
    }

    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(getInputStream(), getCharacterEncoding()));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        return new ServletInputStream() {
            ByteArrayInputStream wrapperStream = new ByteArrayInputStream(body);

            @Override
            public boolean isFinished() {
                return false;
            }

            @Override
            public boolean isReady() {
                return false;
            }

            @Override
            public void setReadListener(ReadListener readListener) {

            }

            @Override
            public int read() throws IOException {
                return wrapperStream.read();
            }
        };
    }
}