Java @RequestBody无法转换从AES加密字符串派生的对象

从客户端am传递内容类型为text/plain的AES加密字符串

AES加密字符串在通过过滤器到达控制器之前解密

CustomEncryptedFilter

@Component
@Order(0) 
public class CustomEncryptedFilter implements Filter {

    private static final Logger logger = LogManager.getLogger(CustomEncryptedFilter.class.getName());

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
    throws IOException, ServletException {

        logger.info("************** Encryption Filter - START ***********************");
        String encryptedString = IOUtils.toString(request.getInputStream());
        if (encryptedString != null && encryptedString.length() > 0) {

            byte[] decryptedString = new AESEncrytion().decrypt(encryptedString).getBytes();

            if (request instanceof HttpServletRequest) {

                HttpServletRequest httpServletRequest = (HttpServletRequest) request;
                CustomHttpServletRequestWrapper requestWrapper 
                = new CustomHttpServletRequestWrapper(httpServletRequest,decryptedString);
                                                           
                logger.info("Content Type: {}", requestWrapper.getContentType());
                logger.info("Request Body: {}", IOUtils.toString(requestWrapper.getInputStream()));

                chain.doFilter(requestWrapper, response);

            } else {

                chain.doFilter(request, response);
            }

        } else {

            logger.info("Request is Invalid or Empty");
            chain.doFilter(request, response);
        }

    }

}

public class CustomHttpServletRequestWrapper extends HttpServletRequestWrapper {

    private static final Logger logger = LogManager.getLogger(CustomHttpServletRequestWrapper.class.getName());

    private ByteArrayInputStream requestBody;

    public CustomHttpServletRequestWrapper(HttpServletRequest request, byte[] decryptedString) {
        super(request);
        try {
            requestBody = new ByteArrayInputStream(decryptedString);
        } catch (Exception e) {
            logger.error(e);
            e.printStackTrace();
        }
    }

    @Override
    public String getHeader(String headerName) {
        String headerValue = super.getHeader(headerName);
        if ("Accept".equalsIgnoreCase(headerName)) {
            return headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
        } else if ("Content-Type".equalsIgnoreCase(headerName)) {
            return headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
        }
        return headerValue;
    }

    @SuppressWarnings("unchecked")
    @Override
    public Enumeration getHeaderNames() {

        HttpServletRequest request = (HttpServletRequest) getRequest();

        List list = new ArrayList();

        Enumeration e = request.getHeaderNames();
        while (e.hasMoreElements()) {
            
            String headerName = (String) e.nextElement();
            String headerValue = request.getHeader(headerName);

            if ("Accept".equalsIgnoreCase(headerName)) {
                headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
            } else if ("Content-Type".equalsIgnoreCase(headerName)) {
                headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
            }
            list.add(headerName);
        }
        return Collections.enumeration(list);
    }

    @SuppressWarnings("unchecked")
    @Override
    public Enumeration getHeaders(final String headerName) {

        HttpServletRequest request = (HttpServletRequest) getRequest();

        List list = new ArrayList();

        Enumeration e = request.getHeaders(headerName);
        
        while (e.hasMoreElements()) {

            String header = e.nextElement().toString();

            if (header.equalsIgnoreCase(MediaType.TEXT_PLAIN_VALUE)) {
                header = MediaType.APPLICATION_JSON_VALUE;
            }
            
            list.add(header);
        }
        return Collections.enumeration(list);
    }

    @Override
    public String getContentType() {
        String contentTypeValue = super.getContentType();
        if (MediaType.TEXT_PLAIN_VALUE.equalsIgnoreCase(contentTypeValue)) {
            return MediaType.APPLICATION_JSON_VALUE;
        }
        return contentTypeValue;
    }

    @Override
    public BufferedReader getReader() throws UnsupportedEncodingException {
        return new BufferedReader(new InputStreamReader(requestBody, "UTF-8"));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        return new ServletInputStream() {
            @Override
            public int read() {
                return requestBody.read();
            }

            @Override
            public boolean isFinished() {
                // TODO Auto-generated method stub
                return false;
            }

            @Override
            public boolean isReady() {
                // TODO Auto-generated method stub
                return false;
            }

            @Override
            public void setReadListener(ReadListener listener) {
                // TODO Auto-generated method stub

            }
        };
    }

}

@CrossOrigin(origins = "*", allowedHeaders = "*")
@RestController
@RequestMapping("/api/mobc")
public class HomeController {
    
    private static final Logger logger = LogManager.getLogger(HomeController.class.getName());
    
    @RequestMapping(value="/hello", method=RequestMethod.POST,consumes="application/json", produces="application/json")
    public ResponseEntity<?> Message(@RequestBody LoginForm loginForm,HttpServletRequest request) { 
        
        logger.info("In Home Controller");
        logger.info("Content Type: {}", request.getContentType());
        
        return ResponseEntity.status(HttpStatus.OK).body(loginForm);
    }

}

在这里，我将获得当前的请求主体，它是一个AES加密字符串 然后我解密它转换成一个字符串

encrypted String - Ijwmn5sZ5HqoUPb15c5idjxetqmC8Sln6+d2BPaYzxA=
Original String  - {"username":"thivanka"}

在获得解密的字符串（Json对象）后，我将其附加到请求体 通过扩展HttpServletRequestWrapper

@Component
@Order(0) 
public class CustomEncryptedFilter implements Filter {

    private static final Logger logger = LogManager.getLogger(CustomEncryptedFilter.class.getName());

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
    throws IOException, ServletException {

        logger.info("************** Encryption Filter - START ***********************");
        String encryptedString = IOUtils.toString(request.getInputStream());
        if (encryptedString != null && encryptedString.length() > 0) {

            byte[] decryptedString = new AESEncrytion().decrypt(encryptedString).getBytes();

            if (request instanceof HttpServletRequest) {

                HttpServletRequest httpServletRequest = (HttpServletRequest) request;
                CustomHttpServletRequestWrapper requestWrapper 
                = new CustomHttpServletRequestWrapper(httpServletRequest,decryptedString);
                                                           
                logger.info("Content Type: {}", requestWrapper.getContentType());
                logger.info("Request Body: {}", IOUtils.toString(requestWrapper.getInputStream()));

                chain.doFilter(requestWrapper, response);

            } else {

                chain.doFilter(request, response);
            }

        } else {

            logger.info("Request is Invalid or Empty");
            chain.doFilter(request, response);
        }

    }

}

public class CustomHttpServletRequestWrapper extends HttpServletRequestWrapper {

    private static final Logger logger = LogManager.getLogger(CustomHttpServletRequestWrapper.class.getName());

    private ByteArrayInputStream requestBody;

    public CustomHttpServletRequestWrapper(HttpServletRequest request, byte[] decryptedString) {
        super(request);
        try {
            requestBody = new ByteArrayInputStream(decryptedString);
        } catch (Exception e) {
            logger.error(e);
            e.printStackTrace();
        }
    }

    @Override
    public String getHeader(String headerName) {
        String headerValue = super.getHeader(headerName);
        if ("Accept".equalsIgnoreCase(headerName)) {
            return headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
        } else if ("Content-Type".equalsIgnoreCase(headerName)) {
            return headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
        }
        return headerValue;
    }

    @SuppressWarnings("unchecked")
    @Override
    public Enumeration getHeaderNames() {

        HttpServletRequest request = (HttpServletRequest) getRequest();

        List list = new ArrayList();

        Enumeration e = request.getHeaderNames();
        while (e.hasMoreElements()) {
            
            String headerName = (String) e.nextElement();
            String headerValue = request.getHeader(headerName);

            if ("Accept".equalsIgnoreCase(headerName)) {
                headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
            } else if ("Content-Type".equalsIgnoreCase(headerName)) {
                headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
            }
            list.add(headerName);
        }
        return Collections.enumeration(list);
    }

    @SuppressWarnings("unchecked")
    @Override
    public Enumeration getHeaders(final String headerName) {

        HttpServletRequest request = (HttpServletRequest) getRequest();

        List list = new ArrayList();

        Enumeration e = request.getHeaders(headerName);
        
        while (e.hasMoreElements()) {

            String header = e.nextElement().toString();

            if (header.equalsIgnoreCase(MediaType.TEXT_PLAIN_VALUE)) {
                header = MediaType.APPLICATION_JSON_VALUE;
            }
            
            list.add(header);
        }
        return Collections.enumeration(list);
    }

    @Override
    public String getContentType() {
        String contentTypeValue = super.getContentType();
        if (MediaType.TEXT_PLAIN_VALUE.equalsIgnoreCase(contentTypeValue)) {
            return MediaType.APPLICATION_JSON_VALUE;
        }
        return contentTypeValue;
    }

    @Override
    public BufferedReader getReader() throws UnsupportedEncodingException {
        return new BufferedReader(new InputStreamReader(requestBody, "UTF-8"));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        return new ServletInputStream() {
            @Override
            public int read() {
                return requestBody.read();
            }

            @Override
            public boolean isFinished() {
                // TODO Auto-generated method stub
                return false;
            }

            @Override
            public boolean isReady() {
                // TODO Auto-generated method stub
                return false;
            }

            @Override
            public void setReadListener(ReadListener listener) {
                // TODO Auto-generated method stub

            }
        };
    }

}

@CrossOrigin(origins = "*", allowedHeaders = "*")
@RestController
@RequestMapping("/api/mobc")
public class HomeController {
    
    private static final Logger logger = LogManager.getLogger(HomeController.class.getName());
    
    @RequestMapping(value="/hello", method=RequestMethod.POST,consumes="application/json", produces="application/json")
    public ResponseEntity<?> Message(@RequestBody LoginForm loginForm,HttpServletRequest request) { 
        
        logger.info("In Home Controller");
        logger.info("Content Type: {}", request.getContentType());
        
        return ResponseEntity.status(HttpStatus.OK).body(loginForm);
    }

}

除了添加新的请求正文，我还将MediaType从text/plain更改为 到application/json，以便我的@RequestBody注释获取媒体类型和 执行对象转换

这是我的控制器

@Component
@Order(0) 
public class CustomEncryptedFilter implements Filter {

    private static final Logger logger = LogManager.getLogger(CustomEncryptedFilter.class.getName());

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
    throws IOException, ServletException {

        logger.info("************** Encryption Filter - START ***********************");
        String encryptedString = IOUtils.toString(request.getInputStream());
        if (encryptedString != null && encryptedString.length() > 0) {

            byte[] decryptedString = new AESEncrytion().decrypt(encryptedString).getBytes();

            if (request instanceof HttpServletRequest) {

                HttpServletRequest httpServletRequest = (HttpServletRequest) request;
                CustomHttpServletRequestWrapper requestWrapper 
                = new CustomHttpServletRequestWrapper(httpServletRequest,decryptedString);
                                                           
                logger.info("Content Type: {}", requestWrapper.getContentType());
                logger.info("Request Body: {}", IOUtils.toString(requestWrapper.getInputStream()));

                chain.doFilter(requestWrapper, response);

            } else {

                chain.doFilter(request, response);
            }

        } else {

            logger.info("Request is Invalid or Empty");
            chain.doFilter(request, response);
        }

    }

}

public class CustomHttpServletRequestWrapper extends HttpServletRequestWrapper {

    private static final Logger logger = LogManager.getLogger(CustomHttpServletRequestWrapper.class.getName());

    private ByteArrayInputStream requestBody;

    public CustomHttpServletRequestWrapper(HttpServletRequest request, byte[] decryptedString) {
        super(request);
        try {
            requestBody = new ByteArrayInputStream(decryptedString);
        } catch (Exception e) {
            logger.error(e);
            e.printStackTrace();
        }
    }

    @Override
    public String getHeader(String headerName) {
        String headerValue = super.getHeader(headerName);
        if ("Accept".equalsIgnoreCase(headerName)) {
            return headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
        } else if ("Content-Type".equalsIgnoreCase(headerName)) {
            return headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
        }
        return headerValue;
    }

    @SuppressWarnings("unchecked")
    @Override
    public Enumeration getHeaderNames() {

        HttpServletRequest request = (HttpServletRequest) getRequest();

        List list = new ArrayList();

        Enumeration e = request.getHeaderNames();
        while (e.hasMoreElements()) {
            
            String headerName = (String) e.nextElement();
            String headerValue = request.getHeader(headerName);

            if ("Accept".equalsIgnoreCase(headerName)) {
                headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
            } else if ("Content-Type".equalsIgnoreCase(headerName)) {
                headerValue.replaceAll(MediaType.TEXT_PLAIN_VALUE, MediaType.APPLICATION_JSON_VALUE);
            }
            list.add(headerName);
        }
        return Collections.enumeration(list);
    }

    @SuppressWarnings("unchecked")
    @Override
    public Enumeration getHeaders(final String headerName) {

        HttpServletRequest request = (HttpServletRequest) getRequest();

        List list = new ArrayList();

        Enumeration e = request.getHeaders(headerName);
        
        while (e.hasMoreElements()) {

            String header = e.nextElement().toString();

            if (header.equalsIgnoreCase(MediaType.TEXT_PLAIN_VALUE)) {
                header = MediaType.APPLICATION_JSON_VALUE;
            }
            
            list.add(header);
        }
        return Collections.enumeration(list);
    }

    @Override
    public String getContentType() {
        String contentTypeValue = super.getContentType();
        if (MediaType.TEXT_PLAIN_VALUE.equalsIgnoreCase(contentTypeValue)) {
            return MediaType.APPLICATION_JSON_VALUE;
        }
        return contentTypeValue;
    }

    @Override
    public BufferedReader getReader() throws UnsupportedEncodingException {
        return new BufferedReader(new InputStreamReader(requestBody, "UTF-8"));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        return new ServletInputStream() {
            @Override
            public int read() {
                return requestBody.read();
            }

            @Override
            public boolean isFinished() {
                // TODO Auto-generated method stub
                return false;
            }

            @Override
            public boolean isReady() {
                // TODO Auto-generated method stub
                return false;
            }

            @Override
            public void setReadListener(ReadListener listener) {
                // TODO Auto-generated method stub

            }
        };
    }

}

@CrossOrigin(origins = "*", allowedHeaders = "*")
@RestController
@RequestMapping("/api/mobc")
public class HomeController {
    
    private static final Logger logger = LogManager.getLogger(HomeController.class.getName());
    
    @RequestMapping(value="/hello", method=RequestMethod.POST,consumes="application/json", produces="application/json")
    public ResponseEntity<?> Message(@RequestBody LoginForm loginForm,HttpServletRequest request) { 
        
        logger.info("In Home Controller");
        logger.info("Content Type: {}", request.getContentType());
        
        return ResponseEntity.status(HttpStatus.OK).body(loginForm);
    }

}

}

不幸的是，我得到了错误。我做错了什么

ExceptionHandlerExceptionResolver - Resolved [org.springframework.http.converter.HttpMessageNotReadableException: Required request body is missing

可能的问题 我假设

IOUtils.toString（InputStream）

从

InputStream

读取所有字节。但是，

InputStream

只能读取一次

你的日志记录声明

logger.info("Request Body: {}", IOUtils.toString(requestWrapper.getInputStream()));

读取

输入流

，因此Spring无法再次读取它。尝试将

IOUtils.toString（requestWrapper.getInputStream（））

替换为

新字符串（encryptedString，Charset.defaultCharset（））

其他实施建议 您可以实现自定义

RequestBodyAdvice

，它将解密消息并在需要时更改头

从Spring的JavaDoc开始：

此契约的实现可以直接在RequestMappingHandlerAdapter中注册，或者更可能使用@ControllerAdvice进行注释，在这种情况下，它们是自动检测到的

下面是通知的一个示例实现，它将消息的第一个字节更改为

{

，最后一个字节更改为

}

。您的实现可以修改消息并对其进行解密

@ControllerAdvice
class CustomRequestBodyAdvice extends RequestBodyAdviceAdapter {

    @Override
    public boolean supports(MethodParameter methodParameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
        return true;
    }

    @Override
    public HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage, MethodParameter parameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) throws IOException {
        try (InputStream inputStream = inputMessage.getBody()) {
            byte[] bytes = inputStream.readAllBytes();
            bytes[0] = 0x7b; // 0x7b = '{'
            bytes[bytes.length - 1] = 0x7d; // 0x7d = '}'
            return new CustomMessage(new ByteArrayInputStream(bytes), inputMessage.getHeaders());
        }
    }
}

class CustomMessage implements HttpInputMessage {

    private final InputStream body;
    private final HttpHeaders httpHeaders;

    public CustomMessage(InputStream body, HttpHeaders httpHeaders) {
        this.body = body;
        this.httpHeaders = httpHeaders;
    }

    @Override
    public InputStream getBody() throws IOException {
        return this.body;
    }

    @Override
    public HttpHeaders getHeaders() {
        return this.httpHeaders;
    }
}

---

如果有人对此感到困惑，那么答案就是使用ContentCachingRequestWrapper。另一种方法是使用@geobreze建议的面向方面的变体，它解决了同样的问题

我只需要修改我的HttpServletRequestWrapper来促进更改

参考文献->

此类通过使用InputStream来缓存请求正文。如果我们 读取其中一个过滤器中的InputStream，然后读取其他后续过滤器中的InputStream 过滤器链中的过滤器无法再读取它。因此 限制，该类不适用于所有情况

---

嗨，谢谢你的意见。我的头更改和解密已经开始工作，但是@Requestbody注释是否应该自动序列化，因为我已经通过HttpServletRequestWrapper更改了Accept头，然后将其传递给控制器？我已经编辑了我的答案，请看一看谢谢您的实现。是的，InputStream中的数据只能读取一次，这是导致此问题的原因。我将RequestWrapper更改为ContentCachingRequestWrapper，解决了这个问题。谢谢你的帮助。