I have a multipart form with a file upload which gets posted as seen below in Chrome developer tools -
------WebKitFormBoundaryUkhJ5180JIBYXzLm
Content-Disposition: form-data; name="_csrf"
8d7f28ad-f436-473c-964e-fe41c42c80e4
------WebKitFormBoundaryUkhJ5180JIBYXzLm
Content-Disposition: form-data; name="_csrf"
8d7f28ad-f436-473c-964e-fe41c42c80e4
------WebKitFormBoundaryUkhJ5180JIBYXzLm--
The data seems to have a proper multipart boundary and the _csrf token included. My Spring application is configured as below for CSRF and multipartfilter -
Beans -
<bean id="tokenRepo"
class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository">
</bean>
<bean id="accessDeniedHandler"
class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
<property name="errorPage"
value="/WEB-INF/files/AccessDenied.html" />
</bean>
<bean id="csrfFilter" class="org.springframework.security.web.csrf.CsrfFilter">
<constructor-arg ref="tokenRepo" />
<property name="accessDeniedHandler" ref="accessDeniedHandler" />
</bean>
<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
<sec:filter-chain-map>
<sec:filter-chain pattern="/**" filters="
csrfFilter" />
</sec:filter-chain-map>
</bean>
<bean id="multipartFilter" class="org.springframework.web.multipart.support.MultipartFilter">
</bean>
web.xml -
<filter>
<filter-name>multipartFilter</filter-name>
<filter-class>org.springframework.web.multipart.support.MultipartFilter</filter-class>
</filter>
<filter>
<filter-name>filterChainProxy</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>multipartFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>filterChainProxy</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
security.xml -
<b:beans xmlns="http://www.springframework.org/schema/security"
xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<http />
</b:beans>
I am using Spring Framework version 4.1.6.RELEASE and Spring Security version 4.0.2.RELEASE and Tomcat 7.
With this setup, the request does not pass multipartfilter and/or CSRF filter - I do not see it entering the filter placed after these 2 in web.xml.
If I change my server's context.xml opening context tag to include allowCasualMultipartParsing="true", the request passes into the next filter after multipartfilter and CSRF filter but when it reaches my controller, Apache Commons FileUpload finds it empty. I have tried wrapping the request in HttpServletRequestWrapper in order to typecast it in different ways but I could not salvage the request.