title: Exception when multipart form POST interrupted by session timeout results in an
body: <p>We have Spring security with CAS (I don't think CAS is the problem).  </p>
  
  <p>The <strong>problem is NOT the session timeout</strong>, rather how this timeout is handled. </p>
  
  <ol>
  <li>request a form: GET /someform</li>
  <li>fill out a multipart form</li>
  <li>restart the server, or delete JSESSIONID</li>
  <li><p>submit the form: POST /someform (with multipart data)</p></li>
  <li><p>user is redirected to the login screen</p></li>
  <li>after login user is redirected to the form: GET /someform</li>
  <li>spring tries to re-post the saved form (I think it's using DefaultSavedRequest)</li>
  <li>it tries to call the controller function mapped to: POST /someform, but the request is not multipart</li>
  <li>we get an exception:</li>
  </ol>
  
  <blockquote>
    <p>Failed to invoke handler method
    [public
    org.springframework.web.servlet.ModelAndView
    com.xxx.xxx.XXXController.xxxPost(org.springframework.web.multipart.MultipartHttpServletRequest)];
    nested exception is
    java.lang.IllegalStateException:
    Current request is not of type
    org.springframework.web.multipart.MultipartHttpServletRequest:
    com.secondmarket.web.UrlLowerCaseFilter$LowerCaseUrlServletRequestWrapper@77fb58b6</p>
  </blockquote>
  
  <p>This is the code that saves the request to the session upon AccessDeniedException, it's in HttpSessionRequestCache (called by ExceptionTranslationFilter):</p>
  
  <pre><code>public void saveRequest(HttpServletRequest request, HttpServletResponse response) {
      if (!justUseSavedRequestOnGet || "GET".equals(request.getMethod())) {
          DefaultSavedRequest savedRequest = new DefaultSavedRequest(request, portResolver);
  
          if (createSessionAllowed || request.getSession(false) != null) {
              // Store the HTTP request itself. Used by AbstractAuthenticationProcessingFilter
              // for redirection after successful authentication (SEC-29)
              request.getSession().setAttribute(WebAttributes.SAVED_REQUEST, savedRequest);
              logger.debug("DefaultSavedRequest added to Session: " + savedRequest);
          }
      }
  
  }
  </code></pre>
  
  <p>How can i owverwrite HttpSessionRequestCache or ExceptionTranslationFilter to NOT save the request if it's a multipart request?</p>