title: Spring Security: deserialize request body twice (oauth2 processing)
body: <p>This question is a result of some work I'm doing with the Spring Security Oauth2 library. I've set up an oauth2 authorization server and an oauth2 resource server, the latter of which is meant to authorize based on access tokens.</p>
  
  <p>The problem is that normally access tokens are passed in a header, but the big client we're setting this up for wants to pass the access token in a JSON request body. There's an interface you can use to set up custom access token extraction, but it looks like this:</p>
  
  <pre><code>public interface TokenExtractor {
  
  /**
   * Extract a token value from an incoming request without authentication.
   * 
   * @param request the current ServletRequest
   * @return an authentication token whose principal is an access token (or null if there is none)
   */
  Authentication extract(HttpServletRequest request);
  }
  </code></pre>
  
  <p>So, as best I can tell, all I have access to is the raw HTTPServletRequest, from which I need to deserialize the request and extract the access token.</p>
  
  <p>Further complicating things, though, is the fact that the request body also contains other parameters needed for processing, so I want to deserialize it to a DTO class that I pass into my controller, something like so:</p>
  
  <pre><code>@RequestMapping("/oauth/someresource")
  @Transactional
  public Map&lt;String, String&gt; resource(@AuthenticationPrincipal UserDetails userDetails,
                                       @RequestBody ClientRequestDto clientRequestDto) {
  // Do some processing based on the request dto
  }
  </code></pre>
  
  <p>I tried manually deserializing the request in the token extractor, but then I get an error "java.lang.IllegalStateException: getReader() has already been called for this request".</p>
  
  <p>I was brainstorming a few possible solutions that I could research, and so far I've come up with: </p>
  
  <ol>
  <li>find a way to reset the input stream</li>
  <li>deserialize the object in the Token Extractor, attach it to the raw request object, and just access the raw request object in my controller instead of using @RequestBody</li>
  <li>like 2, but find a way to add a custom deserializer that fetches the object attached to the raw request instead of processing the request's input stream.</li>
  </ol>
  
  <p>Anyways, those are just some thoughts, if anyone has any ideas in terms of an elegant way of solving this, I'd greatly appreciate it. </p>
  
  <p>EDIT: I did find this question which is similar: <a href="https://stackoverflow.com/questions/32763922/spring-reading-request-body-twice">Spring reading request body twice</a>, and the last answer did have one possible solution (creating a decorator request class that allows multiple input stream reads and creating a filter early on in the filter chain that wraps the HttpServletRequest). It seems workable, but a little heavy duty, so I'll leave this up to see if anyone has any other ideas as well. </p>