HiddenHttpMethodFilter（源码分析）进行请求过滤，实现Rest风格的url

喜欢ヅ旅行 2021-12-11 08:57 165阅读 0赞

浏览器form表单只支持GET与POST请求，而DELETE、PUT等method并不支持，spring3.0添加了一个过滤器，可以将这些请求转换为标准的http方法，使得支持GET、POST、PUT与DELETE请求，该过滤器为HiddenHttpMethodFilter。

HiddenHttpMethodFilter的父类是OncePerRequestFilter，它继承了父类的doFilterInternal方法，工作原理是将jsp页面的form表单的\_method属性值在doFilterInternal方法中转化为标准的Http方法，只能支持PUT、DELETE、TRACE，然后到Controller中找到对应的方法。

Rest 风格的 URL以 CRUD 为例: 
     新增: /order POST 
     修改: /order/1 PUT
     获取:/order/1 GET 
     删除: /order/1 DELETE

注意：idea根据类名查询（eclips风格快捷键）Crtl + Shift +R

以下是源码分析

/**
     * {@link javax.servlet.Filter} that converts posted method parameters into HTTP methods,
     * retrievable via {@link HttpServletRequest#getMethod()}. Since browsers currently only
     * support GET and POST, a common technique - used by the Prototype library, for instance -
     * is to use a normal POST with an additional hidden form field ({@code _method})
     * to pass the "real" HTTP method along. This filter reads that parameter and changes
     * the {@link HttpServletRequestWrapper#getMethod()} return value accordingly.
     * Only {@code "PUT"}, {@code "DELETE"} and {@code "PATCH"} HTTP methods are allowed.
     *
     * <p>The name of the request parameter defaults to {@code _method}, but can be
     * adapted via the {@link #setMethodParam(String) methodParam} property.
     *
     * <p><b>NOTE: This filter needs to run after multipart processing in case of a multipart
     * POST request, due to its inherent need for checking a POST body parameter.</b>
     * So typically, put a Spring {@link org.springframework.web.multipart.support.MultipartFilter}
     * <i>before</i> this HiddenHttpMethodFilter in your {@code web.xml} filter chain.
     *
     * @author Arjen Poutsma
     * @author Juergen Hoeller
     * @since 3.0
     */
    public class HiddenHttpMethodFilter extends OncePerRequestFilter {
    
    	private static final List<String> ALLOWED_METHODS =
    			Collections.unmodifiableList(Arrays.asList(HttpMethod.PUT.name(),
    					HttpMethod.DELETE.name(), HttpMethod.PATCH.name()));
    
    	/** Default method parameter: {@code _method} */
    	public static final String DEFAULT_METHOD_PARAM = "_method";
    
    	private String methodParam = DEFAULT_METHOD_PARAM;
    
    
    	/**
    	 * Set the parameter name to look for HTTP methods.
    	 * @see #DEFAULT_METHOD_PARAM
    	 */
    	public void setMethodParam(String methodParam) {
    		Assert.hasText(methodParam, "'methodParam' must not be empty");
    		this.methodParam = methodParam;
    	}
    //过滤器的核心代码
    	@Override
    	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
    			throws ServletException, IOException {
    
    		HttpServletRequest requestToUse = request;
    
    		if ("POST".equals(request.getMethod()) && request.getAttribute(WebUtils.ERROR_EXCEPTION_ATTRIBUTE) == null) {
    			String paramValue = request.getParameter(this.methodParam);
    			if (StringUtils.hasLength(paramValue)) {
    				String method = paramValue.toUpperCase(Locale.ENGLISH);
    				if (ALLOWED_METHODS.contains(method)) {
    					requestToUse = new HttpMethodRequestWrapper(request, method);
    				}
    			}
    		}
    
    		filterChain.doFilter(requestToUse, response);
    	}
    
    
    	/**
    	 * Simple {@link HttpServletRequest} wrapper that returns the supplied method for
    	 * {@link HttpServletRequest#getMethod()}.
    	 */
    	private static class HttpMethodRequestWrapper extends HttpServletRequestWrapper {
    
    		private final String method;
    
    		public HttpMethodRequestWrapper(HttpServletRequest request, String method) {
    			super(request);
    			this.method = method;
    		}
    
    		@Override
    		public String getMethod() {
    			return this.method;
    		}
    	}
    
    }