Resolving Multiple Reads of POST Request Parameters in Servlet: Application of HttpServletRequestWrapper

Problem Background and Mechanism Analysis

In Java Servlet development, filters are commonly used to handle HTTP requests, such as logging, authentication, or parameter validation. However, developers may encounter a frequent issue: when using the request.getParameter() method to read parameters from POST requests, these parameters become unavailable after the first read, preventing access by subsequent filters or Servlets. This typically occurs because the Servlet specification treats the request body (e.g., form data) as a one-time stream, which is marked as consumed after reading.

Specifically, the getInputStream() method of HttpServletRequest returns a ServletInputStream object that can only be read once. When getParameter() is called, the Servlet container internally reads this stream to parse parameters, after which the stream reaches its end and cannot be read again. This particularly affects POST requests, as GET request parameters are usually passed via URLs and do not involve stream consumption.

Core Solution: Custom HttpServletRequestWrapper

To resolve this issue, one can extend the HttpServletRequestWrapper class by caching the byte data of the request body to enable multiple reads. The following example demonstrates how to create a MultiReadHttpServletRequest class:

public class MultiReadHttpServletRequest extends HttpServletRequestWrapper {
  private ByteArrayOutputStream cachedBytes;

  public MultiReadHttpServletRequest(HttpServletRequest request) {
    super(request);
  }

  @Override
  public ServletInputStream getInputStream() throws IOException {
    if (cachedBytes == null)
      cacheInputStream();

    return new CachedServletInputStream(cachedBytes.toByteArray());
  }
    
  @Override
  public BufferedReader getReader() throws IOException {
    return new BufferedReader(new InputStreamReader(getInputStream()));
  }

  private void cacheInputStream() throws IOException {
    cachedBytes = new ByteArrayOutputStream();
    IOUtils.copy(super.getInputStream(), cachedBytes);
  }

  private static class CachedServletInputStream extends ServletInputStream {
    private final ByteArrayInputStream buffer;

    public CachedServletInputStream(byte[] contents) {
      this.buffer = new ByteArrayInputStream(contents);
    }

    @Override
    public int read() {
      return buffer.read();
    }

    @Override
    public boolean isFinished() {
      return buffer.available() == 0;
    }

    @Override
    public boolean isReady() {
      return true;
    }

    @Override
    public void setReadListener(ReadListener listener) {
      throw new RuntimeException("Not implemented");
    }
  }
}

In this implementation, the cacheInputStream() method uses the Apache Commons IOUtils library to copy the original input stream into a ByteArrayOutputStream, thereby caching the byte data. The overridden getInputStream() method returns a custom CachedServletInputStream that reads from the cached byte array, supporting multiple calls. Note that for newer versions of the Servlet API, additional methods such as isReady and setReadListener may need to be implemented to ensure compatibility.

Application in Filters

In Servlet filters, this solution can be applied by wrapping the original request. The following example shows how to use MultiReadHttpServletRequest in the doFilter method:

public class MyFilter implements Filter {
  @Override
  public void doFilter(ServletRequest request, ServletResponse response,
        FilterChain chain) throws IOException, ServletException {
    MultiReadHttpServletRequest multiReadRequest = new MultiReadHttpServletRequest((HttpServletRequest) request);
    doMyThing(multiReadRequest.getInputStream());
    chain.doFilter(multiReadRequest, response);
  }
}

This approach allows the request body to be read multiple times within the filter chain without affecting subsequent processing. Moreover, since the getParameter() method relies on getInputStream() internally, this solution also supports multiple calls to parameter retrieval methods.

Alternative: Spring Framework's ContentCachingRequestWrapper

For projects using the Spring Framework, ContentCachingRequestWrapper can be considered as a simpler alternative. This class is a wrapper provided by Spring specifically for caching request and response content, suitable for scenarios like logging. Below is an example of its usage:

import org.springframework.web.util.ContentCachingRequestWrapper;
import org.springframework.web.util.ContentCachingResponseWrapper;

public class LoggingFilter implements Filter {
  @Override
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
          throws IOException, ServletException {
    ContentCachingRequestWrapper requestWrapper = new ContentCachingRequestWrapper((HttpServletRequest) request);
    ContentCachingResponseWrapper responseWrapper = new ContentCachingResponseWrapper((HttpServletResponse) response);
    try {
      chain.doFilter(requestWrapper, responseWrapper);
    } finally {
      String requestBody = new String(requestWrapper.getContentAsByteArray());
      String responseBody = new String(responseWrapper.getContentAsByteArray());
      responseWrapper.copyBodyToResponse();
    }
  }
}

This method avoids the complexity of manually caching byte streams but depends on the Spring ecosystem. Developers should choose the appropriate solution based on project requirements.

Conclusion and Best Practices

When addressing the issue of multiple reads of POST request parameters in Servlets, the core lies in caching the request body data. A custom HttpServletRequestWrapper provides a flexible and general-purpose solution suitable for pure Servlet environments. Meanwhile, Spring's ContentCachingRequestWrapper simplifies implementation for Spring-based projects. In practice, it is advisable to evaluate performance impacts, such as memory usage, as caching large amounts of data may increase overhead. Additionally, ensure handling of exceptional cases, such as stream read errors, to enhance application robustness.