Validation with Spring Security

[Former user]

I'm using swagger request validator with spring security in my Sprint Boot 2.1.3 application.

It seems that the OpenApiValidationInterceptor waits for a ResettableRequestServletWrapper but since the goes through the security layer, it only have a SecurityContextHolderAwareRequestWrapper

How can I make it work?

[Willi Schönborn]

You could register the validation filter before Spring's security filter.

[Fabrice Gabolde]

The general issue here is that the OpenApiValidationFilter needs to run last; otherwise there is a risk that by the time the OpenApiValidationInterceptor gets a chance to run, the ResettableRequestServletWrapper has been wrapped in something else (need to rewrite parameters? need to stash the request body somewhere? can’t do it except by wrapping the servlet request), and validation gets disabled.

But it also needs to run before any filter that could rewrite the parameter names, otherwise it is not validating the correct parameters. I need such a filter, for reasons beyond my control, and it is of course wrapping its input servlet request.

What can I do?

[Sven Döring]

@Fabrice Gabolde @Fabrice Gabolde I see a possibility to achieve that.

Add the OpenApiValidationFilter with the right @Order annotation so the filters will be called in the correct order.

Than create a new class WrappedOpenApiValidationInterceptor there you extend the default OpenApiValidationInterceptor.
In the preHandle method - if you encounter one of your wrapped request classes - unwrap the wrapped ResettableRequestServletWrapper and call the original OpenApiValidationInterceptor preHandle method.

[James Navin]

I am resolving this issue due to inactivity. Please feel free to re-open if Sven’s suggestion does not fix the issue.