ServletRequest getParameter, getInputStream, getReader

[Roel Storms <ro...@gmail.com>]

Hello,

I am working on a Valve that does some integrity checking on HTTP requests
(the details aren't important) where I need this valve to have access to
the HTTP request body as well. I used request.getInputStream to fetch the
data. However when a web application makes use of my valve, the
getParameter method does not return the parameters submitted via POST
anymore. This is documented behavior according to the spec of
ServletRequest (
https://tomcat.apache.org/tomcat-8.0-doc/servletapi/javax/servlet/ServletRequest.html#getInputStream()
).

I was wondering why it was designed this way, since numerous complaints
have arisen from this behavior and some ugly workarounds have been devised
which unfortunately stop working from Tomcat 7 (servlet 3.0):

https://stackoverflow.com/questions/10210645/http-servlet-request-lose-params-from-post-body-after-read-it-once

This shows how easily code like this could break.

Overwriting getInputStream to return a cached version doesn't work anymore
since the parameter attribute isn't populated by using getInputStream. How
exactly it is populated remains a mystery to me. Any advice on how to solve
this properly?

Performing an integrity check without getInputStream or getReader but with
getParameters, will not work if the data submitted is not in the expected
format.

Kind regards,

Roel Storms

Re: ServletRequest getParameter, getInputStream, getReader

[Mark Thomas <ma...@apache.org>]

This belongs on the users list, not the dev list.

Mark


On 22/11/2015 19:49, Roel Storms wrote:
> Hello,
> 
> I am working on a Valve that does some integrity checking on HTTP requests
> (the details aren't important) where I need this valve to have access to
> the HTTP request body as well. I used request.getInputStream to fetch the
> data. However when a web application makes use of my valve, the
> getParameter method does not return the parameters submitted via POST
> anymore. This is documented behavior according to the spec of
> ServletRequest (
> https://tomcat.apache.org/tomcat-8.0-doc/servletapi/javax/servlet/ServletRequest.html#getInputStream()
> ).
> 
> I was wondering why it was designed this way, since numerous complaints
> have arisen from this behavior and some ugly workarounds have been devised
> which unfortunately stop working from Tomcat 7 (servlet 3.0):
> 
> https://stackoverflow.com/questions/10210645/http-servlet-request-lose-params-from-post-body-after-read-it-once
> 
> This shows how easily code like this could break.
> 
> Overwriting getInputStream to return a cached version doesn't work anymore
> since the parameter attribute isn't populated by using getInputStream. How
> exactly it is populated remains a mystery to me. Any advice on how to solve
> this properly?
> 
> Performing an integrity check without getInputStream or getReader but with
> getParameters, will not work if the data submitted is not in the expected
> format.
> 
> Kind regards,
> 
> Roel Storms
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org