HiddenHttpMethodFilter consumes input stream of POST request

[MatejLiszkaCGI]

HiddenHttpMethodFilter implementation consumes input stream without replacing it by any substitution in the wrapper being returned. This causes serious issues in Spring Boot applications where the input stream is read.

[MatejLiszkaCGI]

I found out later on that a workaround (NOT a fix) had been introduced in version 2.2.2 (which is useful and let's keep the option), commit d22c3e2787f6fc32a78eebb8e5d8ea400270df01 but please fix the filter itself, it really breaks the logic of servlet filters! Workaround is NOT a fix of the wrong implementation.

[rstoyanchev]

Form data content is cached and accessible repeatedly via ServerWebExchange#getFormData(). It is documented that we expect all usages of form data to go through that. Also data binding via @ModelAttribute should work without problems through that.

So this is most likely expected behavior, but can you please provide more details about scenario and use of the API?

I found out later on that a workaround (NOT a fix) had been introduced in version 2.2.2

Actually that property was added in 2.1, see spring-projects/spring-boot#14030. In 2.2. the filter is disabled by default, see spring-projects/spring-boot#16953.

[MatejLiszkaCGI]

Spring Boot is sometimes used with proprietary non-Spring servlet implementations. Any servlet filter that breaks usability of servlet API may cause some servlets stop working. In any case, reading the input stream in POST request (through calling getParameter or directly) is a bad practise unless the stream is reconstructed to usable state in the request wrapper returned. That's the point. I am not saying that it does not work at all. I am saying that the design is wrong and it can affect some applications that rely on servlet API (and not only Spring API).

[rstoyanchev]

I realize now you're talking about the Servlet based filter, so please disregard my previous comment about ServerWebExchange.

For the Servlet side of things, HiddenHttpMethodFilter is simply accessing a request parameter, which is quite a common thing to do and can happen in any other part of the code. I don't think it's reasonable to expect any code that touches request parameters to wrap the request to preserve the body. That wouldn't even be possible everywhere.

In the Servlet API it's expected to access form data via request parameters, and any code that wants to read the raw form data instead needs to be prepared for the possibility that the body may have been parsed already. This is why we have the following for use with @RequestBody arguments.