RESTEasy Reactive: add ability to invoke filters once the form parameters are read

[FroMage]

Description

I need to set a filter that checks every POST request for the existence of a CRSF value, but when my filter is invoked, the form is not read yet:

    @ServerRequestFilter
    public void filterRequest(HttpServerRequest req) {
        // check CRSF param for every method except the three safe ones
        if (req.method() != HttpMethod.GET
                && req.method() != HttpMethod.HEAD
                && req.method() != HttpMethod.OPTIONS) {
            //FIXME: can't do this for now because form values are not read when filter is invoked
            CurrentVertxRequest currentVertxRequest = CDI.current().select(CurrentVertxRequest.class).get();
            ResteasyReactiveRequestContext rrContext = (ResteasyReactiveRequestContext) currentVertxRequest
                    .getOtherHttpContextObject();
            FormData formData = rrContext.getFormData();
        }
    }

It would be nice to have an option to delay filters to after the form is read, perhaps with @ServerRequestFilter(readBody = true)

Implementation ideas

No response

[quarkus-bot]

/cc @geoand, @stuartwdouglas

[geoand]

Sounds interesting

[FroMage]

OK, so funny thing: this works when the endpoint has @FormParam elements that forces us to read the body, but doesn't when the endpoint is a @POST method with zero @FormParam. Can we force the body reading if we have filters like that? Should I open a new issue?

[geoand]

We probably can. Please open a new issue

[FroMage]

Done, thanks!

[jimbogithub]

@FroMage Are you able to describe the exact circumstances under which this will currently work? I need a filter to do an HMAC calc for security reasons and it needs all the form data. I'm using @ServerRequestFilter(readBody = true) for the filter and the endpoint is @POST with multiple @FormParams. This seems to fit with what you describe above but in my case the FormData is still always null. (2.9.2.Final)

I can't do the calc just from the individual @FormParams as the caller may include fields I'm unaware of that still need to be in the HMAC.

This was easy with REST Classic and is currently a showstopper for migrating to Reactive.

[jimbogithub]

Resolved. Needed to req.setExpectMultipart(true) and use a binding to ensure it only applies to endpoints expecting form data, e.g.

@HMACAuthenticated
@ServerRequestFilter(readBody = true)
public void filterRequest(HttpServerRequest req) {
    req.setExpectMultipart(true);
}