Spring Security&多部分请求 [英] Spring Security & Multipart requests

问题描述

  
 > @Controller 
 @RequestMapping（value =/ api / image）
 public class ImageController {
 
 @PreAuthorize（hasAuthority（'ROLE_USER'））
 @RequestMapping（value =/ upload，method = RequestMethod.PUT）
 public @ResponseBody帐户putImage（@RequestParam（title）字符串标题，MultipartHttpServletRequest请求，Principal主体）{
 //某些类型的文件处理... 
 System.out.println（------------------------------- ------------）; 
 System.out.println（Test upload：+ title）; 
 System.out.println（Test upload：+ request.getFile（file）。getOriginalFilename（））; 
 System.out.println（--------------------------------------- ----）; （（Account）（（OAuth2Authentication）principal）.getPrincipal（））; 
 
 return 
 
 
 $ / code $ / pre 
 
当我尝试上传文件和标题时，得到以下例外。我将Content-Type头设置为multipart / form-data。 
 
 
  java.lang.IllegalStateException：当前请求不是在org.springframework.web.servlet.mvc.method.annotation.ServletRequestMethodArgumentResolver中输入[org.springframework.web.multipart.MultipartHttpServletRequest]：SecurityContextHolderAwareRequestWrapper [FirewalledRequest [org.apache.catalina.connector.RequestFacade@1aee75b7]] 
 .resolveArgument（ServletRequestMethodArgumentResolver.java:84）
 at org.springframework.web.method.support.HandlerMethodArgumentResolverComposite.resolveArgument（HandlerMethodArgumentResolverComposite.java:75）
 at org.springframework.web.method.support.InvocableHandlerMethod .getMethodArgumentValues（InvocableHandlerMethod.java:156）
 at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest（InvocableHandlerMethod.java:117）
  
如何在Spring Security后面进行文件上传？这似乎是请求永远不会变成一个MultiPartHttpServerRequest，所以它不起作用？
 
 
如果我改变我的方法签名采取@RequestParam MultipartFile，那么我得到例如：
 
 $ p $  DEBUG DefaultListableBeanFactory  - 返回单例bean'imageController'的缓存实例
 DEBUG ExceptionHandlerExceptionResolver  - 解决异常处理程序[公共com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage（java.lang.String，org.springframework.web.multipart.MultipartFile，java.security.Principal）]：java。 lang.IllegalArgumentException：期望MultipartHttpServletRequest：是否配置了MultipartResolver？ 
 DEBUG ResponseStatusExceptionResolver  - 解决处理异常[public com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage（java.lang.String，org.springframework.web.multipart.MultipartFile， java.security.Principal）]：java.lang.IllegalArgumentException：期望MultipartHttpServletRequest：是一个MultipartResolver配置？ 
 DEBUG DefaultHandlerExceptionResolver  - 解决处理异常[public com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage（java.lang.String，org.springframework.web.multipart.MultipartFile， java.security.Principal）]：java.lang.IllegalArgumentException：期望MultipartHttpServletRequest：是一个MultipartResolver配置？ 
 DEBUG DispatcherServlet  - 无法完成请求
 java.lang.IllegalArgumentException：期望MultipartHttpServletRequest：是否配置了MultipartResolver？ 
 at org.springframework.util.Assert.notNull（Assert.java:112）
  

...但是我在我的XML中配置了MultipartResolver：

$ p $ lt; bean id =multipartResolverclass =org .springframework.web.multipart.commons.CommonsMultipartResolver>
< property name =maxUploadSizevalue =268435456/> <！ - 256 megs - >
< / bean>


我确实看到这个博客文章是关于在Spring 3.0下运行这个功能的 - 但是我试图保持更新，目前正在使用3.1。是否有更新的修复？

解决方案

问题是我使用PUT而不是POST。 Commons FileUpload被硬编码为只接受POST请求文件。

检查 isMultipartContent方法。要解决这个问题，可以使用POST或扩展该类，并重写该方法以使其工作。

我为此打开了 FILEUPLOAD-214 问题。

I have a @Controller protected with Spring Security and OAuth2 in which I am trying to let my users upload a file:

@Controller
@RequestMapping(value = "/api/image")
public class ImageController {

    @PreAuthorize("hasAuthority('ROLE_USER')")
    @RequestMapping(value = "/upload", method = RequestMethod.PUT)
    public @ResponseBody Account putImage(@RequestParam("title") String title, MultipartHttpServletRequest request, Principal principal){
        // Some type of file processing...
        System.out.println("-------------------------------------------");
        System.out.println("Test upload: " + title);
        System.out.println("Test upload: " + request.getFile("file").getOriginalFilename());
        System.out.println("-------------------------------------------");

        return ((Account) ((OAuth2Authentication) principal).getPrincipal());
    }
}

When I try to upload a file and title, I get the following exception. I am setting the Content-Type header to multipart/form-data.

java.lang.IllegalStateException: Current request is not of type [org.springframework.web.multipart.MultipartHttpServletRequest]: SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.connector.RequestFacade@1aee75b7]]
    at org.springframework.web.servlet.mvc.method.annotation.ServletRequestMethodArgumentResolver.resolveArgument(ServletRequestMethodArgumentResolver.java:84)
    at org.springframework.web.method.support.HandlerMethodArgumentResolverComposite.resolveArgument(HandlerMethodArgumentResolverComposite.java:75)
    at org.springframework.web.method.support.InvocableHandlerMethod.getMethodArgumentValues(InvocableHandlerMethod.java:156)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:117)

How can I do file uploads behind Spring Security? It seems like the request never gets turned into a MultiPartHttpServerRequest and so it doesn't work?

If I change my method signature to take a @RequestParam MultipartFile, then I get an exception like:

DEBUG DefaultListableBeanFactory - Returning cached instance of singleton bean 'imageController'
DEBUG ExceptionHandlerExceptionResolver - Resolving exception from handler [public com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage(java.lang.String,org.springframework.web.multipart.MultipartFile,java.security.Principal)]: java.lang.IllegalArgumentException: Expected MultipartHttpServletRequest: is a MultipartResolver configured?
DEBUG ResponseStatusExceptionResolver - Resolving exception from handler [public com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage(java.lang.String,org.springframework.web.multipart.MultipartFile,java.security.Principal)]: java.lang.IllegalArgumentException: Expected MultipartHttpServletRequest: is a MultipartResolver configured?
DEBUG DefaultHandlerExceptionResolver - Resolving exception from handler [public com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage(java.lang.String,org.springframework.web.multipart.MultipartFile,java.security.Principal)]: java.lang.IllegalArgumentException: Expected MultipartHttpServletRequest: is a MultipartResolver configured?
DEBUG DispatcherServlet - Could not complete request
java.lang.IllegalArgumentException: Expected MultipartHttpServletRequest: is a MultipartResolver configured?
    at org.springframework.util.Assert.notNull(Assert.java:112)

...but I do have a MultipartResolver configured in my XML:

<bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
    <property name="maxUploadSize" value="268435456"/> <!-- 256 megs -->
</bean>

I did see this blog post about getting this working under Spring 3.0 - but I'm trying to stay more up to date and am using 3.1 currently. Is there perhaps an updated fix?

解决方案

The problem is that I'm using a PUT instead of a POST. Commons FileUpload is hard coded to only accept POST requests for files.

Check the isMultipartContent method there. To fix this, either use a POST or extend that class and override that method to work how you like.

I opened FILEUPLOAD-214 for this issue.

这篇关于Spring Security&多部分请求的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！