This belongs on the users list, not the dev list. Mark
On 22/11/2015 19:49, Roel Storms wrote: > Hello, > > I am working on a Valve that does some integrity checking on HTTP requests > (the details aren't important) where I need this valve to have access to > the HTTP request body as well. I used request.getInputStream to fetch the > data. However when a web application makes use of my valve, the > getParameter method does not return the parameters submitted via POST > anymore. This is documented behavior according to the spec of > ServletRequest ( > https://tomcat.apache.org/tomcat-8.0-doc/servletapi/javax/servlet/ServletRequest.html#getInputStream() > ). > > I was wondering why it was designed this way, since numerous complaints > have arisen from this behavior and some ugly workarounds have been devised > which unfortunately stop working from Tomcat 7 (servlet 3.0): > > https://stackoverflow.com/questions/10210645/http-servlet-request-lose-params-from-post-body-after-read-it-once > > This shows how easily code like this could break. > > Overwriting getInputStream to return a cached version doesn't work anymore > since the parameter attribute isn't populated by using getInputStream. How > exactly it is populated remains a mystery to me. Any advice on how to solve > this properly? > > Performing an integrity check without getInputStream or getReader but with > getParameters, will not work if the data submitted is not in the expected > format. > > Kind regards, > > Roel Storms > --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
