Class HiddenHttpMethodFilter

java.lang.Object

org.springframework.web.filter.GenericFilterBean

org.springframework.web.filter.OncePerRequestFilter

org.springframework.web.filter.HiddenHttpMethodFilter

All Implemented Interfaces:

jakarta.servlet.Filter, Aware, BeanNameAware, DisposableBean, InitializingBean, EnvironmentAware, EnvironmentCapable, ServletContextAware

public class HiddenHttpMethodFilter
extends OncePerRequestFilter

Filter that converts posted method parameters into HTTP methods, retrievable via HttpServletRequest.getMethod(). Since browsers currently only support GET and POST, a common technique - used by the Prototype library, for instance - is to use a normal POST with an additional hidden form field (_method) to pass the "real" HTTP method along. This filter reads that parameter and changes the HttpServletRequestWrapper.getMethod() return value accordingly. Only "PUT", "DELETE" and "PATCH" HTTP methods are allowed.

The name of the request parameter defaults to _method, but can be adapted via the methodParam property.

NOTE: This filter needs to run after multipart processing in case of a multipart POST request, due to its inherent need for checking a POST body parameter. So typically, put a Spring MultipartFilter before this HiddenHttpMethodFilter in your web.xml filter chain.

Since:

3.0

Author:

Arjen Poutsma, Juergen Hoeller

Field Summary

Fields

Modifier and Type	Field	Description
static final String	DEFAULT_METHOD_PARAM	Default method parameter: _method.

Fields inherited from class OncePerRequestFilter

ALREADY_FILTERED_SUFFIX

Fields inherited from class GenericFilterBean

logger

Constructor Summary

Constructors

Constructor	Description
HiddenHttpMethodFilter()

Method Summary

Modifier and Type	Method	Description
protected void	doFilterInternal(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, jakarta.servlet.FilterChain filterChain)	Same contract as for doFilter, but guaranteed to be just invoked once per request within a single request thread.
void	setMethodParam(String methodParam)	Set the parameter name to look for HTTP methods.

Methods inherited from class OncePerRequestFilter

doFilter, doFilterNestedErrorDispatch, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilter, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatch

Methods inherited from class GenericFilterBean

addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_METHOD_PARAM

public static final String DEFAULT_METHOD_PARAM

Default method parameter: _method.

See Also:

• Constant Field Values

Constructor Details

HiddenHttpMethodFilter

public HiddenHttpMethodFilter()

Method Details

setMethodParam

public void setMethodParam(String methodParam)

Set the parameter name to look for HTTP methods.

See Also:

• DEFAULT_METHOD_PARAM

doFilterInternal

protected void doFilterInternal(jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response,
 jakarta.servlet.FilterChain filterChain)
                         throws jakarta.servlet.ServletException,
IOException

Description copied from class: OncePerRequestFilter

Same contract as for doFilter, but guaranteed to be just invoked once per request within a single request thread. See OncePerRequestFilter.shouldNotFilterAsyncDispatch() for details.

Provides HttpServletRequest and HttpServletResponse arguments instead of the default ServletRequest and ServletResponse ones.

Specified by:

doFilterInternal in class OncePerRequestFilter

Throws:

jakarta.servlet.ServletException

IOException