CharacterEncodingFilter don't work together with Spring Security 3.2.0

问题:

I'm new to Spring MVC framework and I have got an issue that I can not resolve by myself. Everything started when I integrated spring security with my application, after that all unicode values from HTML form were not encoded (spring security works correctly). I came to conclusion that this is happening probably because my DelegatingFilterProxy is called as the first filter in the chain.

Here is my configuration that I thought will work, but it doesn't:

1)I'm extending AbstractSecurityWebApplicationInitializer - from javadoc:

Registers the DelegatingFilterProxy to use the springSecurityFilterChain() before any other registered Filter. 

From that class I also override beforeSpringSecurityFilterChain method which regarding to javadoc:

Invoked before the springSecurityFilterChain is added. 

So I thought this will be the best place to register CharacterEncodingFilter:

public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {     @Override     protected void beforeSpringSecurityFilterChain(ServletContext servletContext) {         FilterRegistration.Dynamic characterEncodingFilter = servletContext.addFilter("encodingFilter", new CharacterEncodingFilter());         characterEncodingFilter.setInitParameter("encoding", "UTF-8");         characterEncodingFilter.setInitParameter("forceEncoding", "true");         characterEncodingFilter.addMappingForUrlPatterns(null, true, "/*");     } } 

But this do not work.

Another option I tired was to register filter through AbstractAnnotationConfigDispatcherServletInitializer class by overriding getServletFilters() method:

public class WebAppInitializer extends         AbstractAnnotationConfigDispatcherServletInitializer {      //{!begin addToRootContext}     @Override     protected Class>[] getRootConfigClasses() {         return new Class>[] { SecurityConfig.class, DatabaseConfig.class, InternationalizationConfig.class };     }     //{!end addToRootContext}      @Override     protected Class>[] getServletConfigClasses() {         return new Class>[] { WebAppConfig.class };     }      @Override     protected String[] getServletMappings() {         return new String[] { "/" };     }      @Override     protected Filter[] getServletFilters() {          CharacterEncodingFilter characterEncodingFilter = new CharacterEncodingFilter();         characterEncodingFilter.setEncoding("UTF-8");         characterEncodingFilter.setForceEncoding(true);         return new Filter[] { characterEncodingFilter};     } } 

But this do not work neither. Does anyone come across the same issue or have got some ideas how to resolve this?

Here is my full configuration for the first option where I'm registering encoding filter through AbstractSecurityWebApplicationInitializer:

@Order(1) public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {     @Override     protected void beforeSpringSecurityFilterChain(ServletContext servletContext) {         FilterRegistration.Dynamic characterEncodingFilter = servletContext.addFilter("encodingFilter", new CharacterEncodingFilter());         characterEncodingFilter.setInitParameter("encoding", "UTF-8");         characterEncodingFilter.setInitParameter("forceEncoding", "true");         characterEncodingFilter.addMappingForUrlPatterns(null, true, "/*");     } }  @Order(2) public class WebAppInitializer extends         AbstractAnnotationConfigDispatcherServletInitializer {      //{!begin addToRootContext}     @Override     protected Class>[] getRootConfigClasses() {         return new Class>[] { SecurityConfig.class, DatabaseConfig.class, InternationalizationConfig.class };     }     //{!end addToRootContext}      @Override     protected Class>[] getServletConfigClasses() {         return new Class>[] { WebAppConfig.class };     }      @Override     protected String[] getServletMappings() {         return new String[] { "/" };     } }  @EnableWebMvc //@Import(value = {DatabaseConfig.class, InternationalizationConfig.class, SecurityConfig.class}) @ComponentScan(basePackages = {"com.ajurasz.controller", "com.ajurasz.service", "com.ajurasz.model"}) @Configuration public class WebAppConfig extends WebMvcConfigurerAdapter {      @Bean     public UrlBasedViewResolver viewResolver() {         UrlBasedViewResolver urlBasedViewResolver = new UrlBasedViewResolver();         urlBasedViewResolver.setViewClass(TilesView.class);         urlBasedViewResolver.setContentType("text/html;charset=UTF-8");         return urlBasedViewResolver;     }      @Bean     public TilesConfigurer tilesConfigurer() {         TilesConfigurer tilesConfigurer = new TilesConfigurer();         tilesConfigurer.setDefinitions(new String[] {"/WEB-INF/tiles.xml"});         return tilesConfigurer;     }      @Override     public void addResourceHandlers(ResourceHandlerRegistry registry) {         registry.addResourceHandler("/resources/**").addResourceLocations("/resources/**");         registry.addResourceHandler("/documents/**").addResourceLocations("/WEB-INF/pdfs/documents/**");     }      @Override     public void addArgumentResolvers(List argumentResolvers) {         PageableHandlerMethodArgumentResolver pageableHandlerMethodArgumentResolver =                 new PageableHandlerMethodArgumentResolver();         pageableHandlerMethodArgumentResolver.setFallbackPageable(new PageRequest(0, 4, new Sort(Sort.Direction.DESC, "id")));          argumentResolvers.add(pageableHandlerMethodArgumentResolver);     } } 

Dependencies:

spring-mvc 3.2.5.RELEASE

spring-security-config, spring-security-web, spring-security-core 3.2.0.RELEASE

I'm working on this under following link: https://github.com/ajurasz/Manager

回答1:

Have the same problem. My solution was to use a raw servlet filter:

public void onStartup(ServletContext servletContext) throws ServletException {       FilterRegistration.Dynamic encodingFilter = servletContext.addFilter("encoding-filter", new CharacterEncodingFilter());       encodingFilter.setInitParameter("encoding", "UTF-8");       encodingFilter.setInitParameter("forceEncoding", "true");       encodingFilter.addMappingForUrlPatterns(null, true, "/*"); } 

Note that this problem only occures with Tomcat but not with Jetty.

回答2:

We need to add CharacterEncodingFilter before filters who read request properties for the first time. There is securityFilterChain (stands second. after metrica filter) and we can add our filter inside it. The first filter (inside security chain) who reads properties is CsrfFilter, so we place CharacterEncodingFilter before it.

The short solution is:

@Configuration @EnableWebMvcSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter {     @Override     protected void configure(HttpSecurity http) throws Exception {         CharacterEncodingFilter filter = new CharacterEncodingFilter();         filter.setEncoding("UTF-8");         filter.setForceEncoding(true);         http.addFilterBefore(filter,CsrfFilter.class);         //rest of your code        } //rest of your code } 

回答3:

I ran into the same issue recently and your first try is actually very close to the solution I ended up using (here's your code, fixed) :

public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer { @Override protected void beforeSpringSecurityFilterChain(ServletContext servletContext) {     FilterRegistration.Dynamic characterEncodingFilter = servletContext.addFilter("encodingFilter", new CharacterEncodingFilter());     characterEncodingFilter.setInitParameter("encoding", "UTF-8");     characterEncodingFilter.setInitParameter("forceEncoding", "true");     characterEncodingFilter.addMappingForUrlPatterns(null, false, "/*");     } } 

The only difference is the second argument when adding filter mapping for url patterns. The Javadoc for this parameter states :

isMatchAfter - true if the given filter mapping should be matched after any declared filter mappings, and false if it is supposed to be matched before any declared filter mappings of the ServletContext from which this FilterRegistration was obtained

So setting it to false should cleanly solve your issue (without any XML involved).

回答4:

I don't know what exactly the problem is but I'd never configure such a simple filter inside Spring. Rather do it right in web.xml - easier to develop, understand and debug.

     characterEncodingFilterorg.springframework.web.filter.CharacterEncodingFilterencodingUTF-8forceEncodingtruecharacterEncodingFilter/*

Important: configure this filter's mapping before the Spring Security filter chain (i.e. before the filter mapping for DelegatingFilterProxy).

回答5:

I have used

@Configuration @EnableWebMvcSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter {     @Override     protected void configure(HttpSecurity http) throws Exception {         CharacterEncodingFilter filter = new CharacterEncodingFilter();         filter.setEncoding("UTF-8");         filter.setForceEncoding(true);         http.addFilterBefore(filter,CsrfFilter.class);         //rest of your code        } //rest of your code } 

回答6:

I don't like the answers posted so far because either use obscure Spring classes, or rely on implementation details.

In my opinion things should work by simply defining a standard @Bean with high @Order, so this is Boot's fault - but luckily everything works as expected (?) if we use a FilterRegistrationBean instead of a plain Filter (I'm using Boot 1.1.5):

@Bean public FilterRegistrationBean filterRegistrationBean() {     FilterRegistrationBean registrationBean = new FilterRegistrationBean();     CharacterEncodingFilter characterEncodingFilter = new CharacterEncodingFilter();     registrationBean.setFilter(characterEncodingFilter);     characterEncodingFilter.setEncoding("UTF-8");     characterEncodingFilter.setForceEncoding(true);     registrationBean.setOrder(Integer.MIN_VALUE);     registrationBean.addUrlPatterns("/*");     return registrationBean; } 

文章来源: CharacterEncodingFilter don't work together with Spring Security 3.2.0