Spring Security性：反序列化请求主体两次(oauth2处理）

Question

public interface TokenExtractor {

/**
 * Extract a token value from an incoming request without authentication.
 * 
 * @param request the current ServletRequest
 * @return an authentication token whose principal is an access token (or null if there is none)
 */
Authentication extract(HttpServletRequest request);
}

然而，更复杂的是，请求体还包含处理所需的其他参数，因此我希望将其反序列化为传递到控制器中的DTO类，如下所示：

@RequestMapping("/oauth/someresource")
@Transactional
public Map<String, String> resource(@AuthenticationPrincipal UserDetails userDetails,
                                     @RequestBody ClientRequestDto clientRequestDto) {
// Do some processing based on the request dto
}

我尝试在令牌提取器中手动反序列化请求，但随后得到一个错误“java.lang.IllegalStateException：getReader（）已经被调用用于此请求”。

我集思广益地想出了一些我可以研究的可能的解决方案，到目前为止我已经想出了：

null

Answer 1

因此，我最终发现了另一个解决这个问题的问题，这是我在发布之前没有看到的（我如何在Spring的'HandlerMethodArgumentResolver'中多次读取请求体？）。其中一个还建议在HttpServletRequest周围创建一个装饰器，因此我修改了http://www.myjavarecipes.com/how-to-read-post-request-data-twick-in-spring/中的信息，添加了针对大型请求的保护。

以下是我想出来的，以防有人有任何反馈：

public class MultiReadHttpServletRequest extends HttpServletRequestWrapper {
// We include a max byte size to protect against malicious requests, since this all has to be read into memory
public static final Integer MAX_BYTE_SIZE = 1_048_576; // 1 MB

private String _body;

public MultiReadHttpServletRequest(HttpServletRequest request) throws IOException {
    super(request);
    _body = "";

    InputStream bounded = new BoundedInputStream(request.getInputStream(), MAX_BYTE_SIZE);
    BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(bounded));

    String line;
    while ((line = bufferedReader.readLine()) != null){
        _body += line;
    }
}

@Override
public ServletInputStream getInputStream() throws       IOException {
    final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(_body.getBytes());

    return new ServletInputStream() {
        public int read() throws IOException {
            return byteArrayInputStream.read();
        }

        @Override
        public boolean isFinished() {
            return byteArrayInputStream.available() == 0;
        }

        @Override
        public boolean isReady() {
            return true;
        }

        @Override
        public void setReadListener(ReadListener readListener) {

        }
    };
}

@Override
public BufferedReader getReader() throws IOException {
    return new BufferedReader(new InputStreamReader(this.getInputStream()));
}
}

我使用了以下配置：

    @Bean
FilterRegistrationBean multiReadFilter() {
    FilterRegistrationBean registrationBean = new FilterRegistrationBean();
    MultiReadRequestFilter multiReadRequestFilter = new MultiReadRequestFilter();
    registrationBean.setFilter(multiReadRequestFilter);
    registrationBean.setOrder(SecurityProperties.DEFAULT_FILTER_ORDER - 2);
    registrationBean.setUrlPatterns(Sets.newHashSet("/path/here"));
    return registrationBean;
}