Can't login while using MultiReadHttpServletRe

I'm trying to build a simple logging tool that using AspectJ can print the HttpServletRequest body.

For this I created a simple PointCut that catches all executions of javax Filter.doFilter, HttpServlet doPost, doGet, service etc.

I then replace the HttpServletRequest with my own request wrapper that copies the request's body so it can be called more than once so I'll be able to log it. See - https://github.com/Alotor/test-binding/blob/master/src/java/grails/util/http/MultiReadHttpServletRequest.java.

It worked fine so far until I tried to log the body in an application that uses Spring security filters. Now I can't login, seems that somehow the implementation of the HttpServletRequstWrapper is important for Spring, but I can't figure out where and why.

My code (a bit modified from the original, but it gives the idea):

aspect MyAspect {
     pointcut httpCalls(HttpServletRequest req, HttpServletResponse resp):
        args(req, resp, ..) && (execution(void             javax.servlet.Servlet+.service(..))
                || execution(void javax.servlet.Servlet+.doGet(..))
                ...
                || execution(void javax.servlet.Filter.doFilter(..));

   Object around(HttpServletRequest req, HttpServletResponse resp):httpCalls(req,resp) {
    ...
    if (!ThreadContext.getContext().wasReplaced()) { // we need to replace the request
        reqWrapper = new MultiReadHttpServletRequest(req);
        ThreadContext.getContext().setWasReplaced(true);           
        obj = proceed(reqWrapper, resp);
        TraceContextFactory.getFactory().getContext().setWasReplaced(false);
    } else { 
        obj = proceed(req, resp);
    }
    return obj;
  }

}

Any idea why I can't login and this fails to work with Spring security? I saw that they are using their own wrappers, but since the API is the same it should have worked.

For clarification - I'm running an application on tomcat, and I'm not instrumenting org.apache.catalina (it doesn't work, probably due to class loading order that prevents the aspectj from weaving tomcat source code).

Edit:

I see now the the problem is inside the UsernamePasswordAuthenticationFilter.java:

 protected String obtainUsername(HttpServletRequest request) {
    return request.getParameter(usernameParameter);
}

The above returns null in case I use my Wrapper, otherwise it returns "guest", which is the username I used. I did override the inputstream and the reader, but the actual call to getParameter(...) is done through the underlying request which uses the original input stream from org.apache.catalina.connector.RequestFacade.

http://localhost:8081/someApp/j_spring_security_check:

Thanks,

Lin

I couldn't login because spring security called tomcat's org.apache.coyote.Request to read the parameters. The request doesn't use an InputStream, but a BufferInput. Either way, it doesn't use my wrapped InputStream.

There are 2 solutions:

request.getParametersMap() - In case of post calls (such as login, for example spring security j_spring_security_check), you can use request.getParametersMap() and to generate the request body from it.
Use java reflection to replace org.apach.coyote.Request's inputBuffer with your own implementation that allows to read more than once from the stream.

I chose the first option since the latter is too risky IMHO.