title: Resolving multipart/form-data request in spring filter
body: <p>I'm trying to develop my own <code>CSRF filter</code> in Spring MVC 3 (There are some extra trainings that made me do that, thats why Im not considering spring security.)</p>
  
  <p>My filter works fine with all forms except those that have <code>enctype="multipart/form-data"</code>. So I can not get request parameters from normal HttpServletRequest.</p>
  
  <p>I've tried casting <code>HttpServletRequest</code> to <code>MultipartHttpServletRequest</code> but I found out I can not do that either.</p>
  
  <p>My objective is not getting files from the request, but to only get simple form input named <code>csrf</code>. (Ive already uploaded files with my forms)</p>
  
  <p>Here is my code till now:</p>
  
  <p><strong>CSRFilter</strong></p>
  
  <pre><code>public class CSRFilter extends GenericFilterBean {
      @Override
      public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
          HttpServletRequest request = (HttpServletRequest) req;
          HttpServletResponse response = (HttpServletResponse) res;
  
          CSRF csrf = new CSRF(req);
          if(csrf.isOk()){
              chain.doFilter(req, res);
          }else {
              //todo : Show Error Page
              String redirect = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + request.getContextPath() + "/access-forbidden";
              response.sendRedirect(redirect);
          }
  
      }
  }
  </code></pre>
  
  <p><strong>CSRF</strong></p>
  
  <pre><code>public class CSRF {
      HttpServletRequest request;
      ServletRequest req;
      String token;
      boolean ok;
      private static final Logger logger = Logger.getLogger(CSRF.class);
  
  
      public CSRF(ServletRequest request) {
          this.request = (HttpServletRequest) request;
          this.req = request;
          init();
      }
  
      public CSRF() {
      }
  
  
      public void setRequest(HttpServletRequest request) {
          this.request = (HttpServletRequest) request;
          this.req = request;
          init();
      }
  
      private void init() {
          if (request.getMethod().equals("GET")) {
              generateToken();
              addCSRFTokenToSession();
              addCSRFTokenToModelAttribute();
              ok = true;
          } else if (request.getMethod().equals("POST")) {
              if (checkPostedCsrfToken()) {
                  ok = true;
              }
          }
      }
  
      private void generateToken() {
          String token;
          java.util.Date date = new java.util.Date();
          UUID uuid = UUID.randomUUID();
          token = uuid.toString() + String.valueOf(new Timestamp(date.getTime()));
          try {
              this.token = sha1(token);
          } catch (NoSuchAlgorithmException e) {
              e.printStackTrace();
              this.token = token;
          }
      }
  
      private void addCSRFTokenToSession() {
          request.getSession().setAttribute("csrf", token);
      }
  
      private void addCSRFTokenToModelAttribute() {
          request.setAttribute("csrf", token);
      }
  
      private boolean checkPostedCsrfToken() {
          System.out.println("____ CSRF CHECK POST _____");
          if (request.getParameterMap().containsKey("csrf")) {
              String csrf = request.getParameter("csrf");
              if (csrf.equals(request.getSession().getAttribute("csrf"))) {
                  return true;
              }
          }else {
              //Check for multipart requests
  
              MultipartHttpServletRequest multiPartRequest = new DefaultMultipartHttpServletRequest((HttpServletRequest) req);
              if (multiPartRequest.getParameterMap().containsKey("csrf")) {
                  String csrf = multiPartRequest.getParameter("csrf");
                  if (csrf.equals(request.getSession().getAttribute("csrf"))) {
                      return true;
                  }
              }
          }
  
          log();
          return false;
      }
  
      private void log() {
          HttpSession session = request.getSession();
          String username = (String) session.getAttribute("username");
          if(username==null){
              username = "unknown (not logged in)";
          }
          String ipAddress = request.getHeader("X-FORWARDED-FOR");
          if (ipAddress == null) {
              ipAddress = request.getRemoteAddr();
          }
          String userAgent = request.getHeader("User-Agent");
          String address = request.getRequestURI();
          System.out.println("a CSRF attack detected from IP: " + ipAddress + " in address \"" + address + "\" - Client User Agent : " + userAgent + " Username: " + username);
  
          logger.error("a CSRF attack detected from IP: " + ipAddress + " in address \"" + address + "\" - Client User Agent : " + userAgent + " Username: " + username);
      }
  
      public boolean isOk() {
          return ok;
      }
  
      static String sha1(String input) throws NoSuchAlgorithmException {
          MessageDigest mDigest = MessageDigest.getInstance("SHA1");
          byte[] result = mDigest.digest(input.getBytes());
          StringBuffer sb = new StringBuffer();
          for (int i = 0; i &lt; result.length; i++) {
              sb.append(Integer.toString((result[i] &amp; 0xff) + 0x100, 16).substring(1));
          }
          return sb.toString();
      }
  }
  </code></pre>
  
  <p>I have this line in my dispatcher too :</p>
  
  <pre><code>&lt;bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver"&gt;
          &lt;!-- one of the properties available; the maximum file size in bytes --&gt;
          &lt;property name="maxUploadSize" value="40000000"/&gt;
      &lt;/bean&gt;
  </code></pre>
  
  <p>and also I use springMultipartResolver filter ...</p>
  
  <pre><code>&lt;filter&gt;
          &lt;display-name&gt;springMultipartFilter&lt;/display-name&gt;
          &lt;filter-name&gt;springMultipartFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.multipart.support.MultipartFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springMultipartFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  &lt;/filter&gt;
  </code></pre>
  
  <p>I get <code>java.lang.IllegalStateException: Multipart request not initialized</code> Exception when I try it on multipart/form-data forms.</p>
  
  <p>I looked at many Examples in internet. Most of them was for file uploading purpose and could not help me, I also tried different ways to cast HttpServletRequest to any other object that gives me resolved multipart request, But I could not succeed.</p>
  
  <p>How can I do it ?</p>
  
  <p>Thanks.</p>