Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multipart: Invalid boundary with RestTemplate [SPR-17061] #21599

spring-projects-issues opened this issue Jul 18, 2018 · 2 comments

Multipart: Invalid boundary with RestTemplate [SPR-17061] #21599

spring-projects-issues opened this issue Jul 18, 2018 · 2 comments
in: web status: duplicate


Copy link

@spring-projects-issues spring-projects-issues commented Jul 18, 2018

Joe Amoros opened SPR-17061 and commented


I recently upgraded from 4.3.16 to 5.0.7. Everything is running smoothly except when trying to upload a file using the RestTemplate. This was working before the upgrade. 


    public <T> ResponseEntity<T> uploadMultipartFile(String requestParamName, byte[] byteArray, String fileName,Class<T> responseType) {        

ByteArrayResource byteArrayAsResource = new ByteArrayResource(byteArray) {
            public String getFilename() {
                return fileName;

MultipartBodyBuilder bodyBuilder = new MultipartBodyBuilder();
bodyBuilder.part(requestParamName, byteArrayAsResource);        

return getRestTemplate().postForEntity(buildUriWithVariables(new HashMap<>()),, responseType); 


It seems that Apache (2.4.7) is intercepting the request with the following error:

[Wed Jul 18 14:56:55.932180 2018] [:error] [pid 1313:tid 140177733252864] [client] ModSecurity: 
Multipart parsing error (init): Multipart: Invalid boundary in C-T (characters). [hostname ""] 
[uri "/restless/documentUpload/multipleUpload"] [unique_id "W0@Nd38AAAEAAAUhtbcAAABW"]

[Wed Jul 18 14:56:55.932308 2018] [:error] [pid 1313:tid 140177733252864] [client] ModSecurity: 
Access denied with code 400 (phase 2). Match of "eq 0" against "REQBODY_ERROR" required. 
[file "/etc/modsecurity/modsecurity.conf"] [line "54"] [id "200001"] [msg "Failed to parse request body."] 
[data "Multipart: Invalid boundary in C-T (characters)."] [severity "CRITICAL"] [hostname ""] 
[uri "/restless/documentUpload/multipleUpload"] [unique_id "W0@Nd38AAAEAAAUhtbcAAABW"] 


Below is what the body and response looks like, I omitted the file body.

<Sending request: POST /documentUpload/multipleUpload? HTTP/1.1>
"POST /documentUpload/multipleUpload? HTTP/1.1[\r][\n]">
 "Accept: application/json, application/*+json[\r][\n]">
 "Content-Type: multipart/form-data;boundary=rkPSkaQIu7ALPaIp-aTzHLIECYcOgFKCufq5;charset=UTF-8[\r][\n]">
 "Content-Length: 32096[\r][\n]">
 "Connection: Keep-Alive[\r][\n]">
 "User-Agent: Apache-HttpClient/4.5.3 (Java/1.8.0_112)[\r][\n]">
POST /documentUpload/multipleUpload? HTTP/1.1>
Accept: application/json, application/*+json>
Content-Type: multipart/form-data;boundary=rkPSkaQIu7ALPaIp-aTzHLIECYcOgFKCufq5;charset=UTF-8>
Content-Length: 32096>
Connection: Keep-Alive>
User-Agent: Apache-HttpClient/4.5.3 (Java/1.8.0_112)>
 "Content-Disposition: form-data; name="files"; filename="99999888_inv_LP1003.99999888_invStmt_20161001_20161231_invStmt_.pdf"[\r][\n]">
 "Content-Type: application/pdf[\r][\n]">
 "Content-Length: 31830[\r][\n]">"HTTP/1.1 400 Bad Request[\r][\n]">
"Date: Wed, 18 Jul 2018 17:55:22 GMT[\r][\n]">
"Server: Portal[\r][\n]">
"Content-Length: 226[\r][\n]">
"Connection: close[\r][\n]">
"Content-Type: text/html; charset=iso-8859-1[\r][\n]">
<Receiving response: HTTP/1.1 400 Bad Request>
HTTP/1.1 400 Bad Request>
Date: Wed, 18 Jul 2018 17:55:22 GMT>
Server: Portal>
Content-Length: 226>
Connection: close>
Content-Type: text/html; charset=iso-8859-1> 


If I am doing something wrong any help would be greatly appreciated. I thought it was possible the boundary having ;charset after it, but I am not sure how to remove it. After two days I'm exhausted trying to figure this out.

Thank you!!

Affects: 5.0.7

Reference URL:

Issue Links:

  • #21568 Boundary info in Content-Type multipart request header not parsed correctly because of charset ("duplicates")

1 votes, 2 watchers

Copy link
Collaborator Author

@spring-projects-issues spring-projects-issues commented Jul 18, 2018

Joe Amoros commented

Minor addendum, before using MultipartBodyBuilder, I was using the following, but no difference:

MultiValueMap<String, Object> map = new LinkedMultiValueMap<>();
map.add(requestParamName, byteArrayAsResource);
HttpHeaders headers = new HttpHeaders();
HttpEntity<MultiValueMap<String, Object>> requestEntity = new HttpEntity<>(map, headers);

Copy link
Collaborator Author

@spring-projects-issues spring-projects-issues commented Jul 19, 2018

Brian Clozel commented

I'm closing this as a duplicate of #21568

Could you reach out to the apache httpd server project and check with them if this is a bug on their side? Looking at the various RFCs and how encoding is supposed to work here, it doesn't look like adding charset information there is wrong.

Please report your findings on #21568.


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
in: web status: duplicate
None yet

No branches or pull requests

2 participants