Spring: how to pass objects from filters to controllers

Question

I'm trying to add a Filter that creates an object that is then to be used inside a controller in a Spring Boot application.

The idea is to use the Filter as a "centralized" generator of this object - that is request-specific and useful only in a controller. I've tried to use the HttpServletRequest request.getSession().setAttribute method: I can access my object in the controller, but then it will be (clearly) added to the session.

Are the Filters the right way to do so? If yes, where can I keep the temporary object generated by the filter to be used by the controllers?

score 30 · Answer 1 · edited Dec 23 '18 at 21:39

30

Why Don't you use a Bean with the @Scope('request')

@Component
@Scope(value="request", proxyMode= ScopedProxyMode.TARGET_CLASS)
class UserInfo {
   public String getPassword() {
      return password;
   }

   public void setPassword(String password) {
      this.password = password;
   }

   private String password;
}

and then you can Autowireed this bean in both filter and controller to do setting and getting of data.

lifecycle of this UserInfo bean is only exisits within the request so once the http request is done then it terminates the instance as well

edited Dec 23 '18 at 21:39

CuriousGeorge

7,120
6
42
74

answered Jan 21 '17 at 00:42

Imal Hasaranga Perera

9,683
3
51
41

3

Could you please post the full example? – Renann Mar 27 '17 at 19:55
Best answer! Most elegant. – user674669 Mar 31 '18 at 02:09
This is the most suitable answer In the context of Spring or any DI framework like CDI. – Gogol Nov 06 '18 at 11:07
3

Nice answer! Note that a new composed annotation @RequestScope has been introduced to act the same as @Scope(value="request", proxyMode= ScopedProxyMode.TARGET_CLASS) – Will Oct 27 '20 at 13:13
if we store users info in this component, is there any chance that other user can get the data from another request? – Vikum Dheemantha May 06 '21 at 07:50
Also @imal (or anyone!) why is it `@Component`-annotated and _not_ `@Bean`-annotated? I'd think that the `UserInfo` isn't a scannable component, rather, its a request-scoped bean/instance, right? – hotmeatballsoup May 18 '21 at 15:44
1

How does this work? How exactly we can pass it from filter to controller? – hemu Sep 10 '21 at 10:01

score 18 · Accepted Answer · answered Feb 17 '16 at 09:20

you can use ServletRequest.setAttribute(String name, Object o);

for example

@RestController
@EnableAutoConfiguration
public class App {

    @RequestMapping("/")
    public String index(HttpServletRequest httpServletRequest) {
        return (String) httpServletRequest.getAttribute(MyFilter.passKey);
    }

    public static void main(String[] args) {
        SpringApplication.run(App.class, args);
    }

    @Component
    public static class MyFilter implements Filter {

        public static String passKey = "passKey";

        private static String passValue = "hello world";

        @Override
        public void init(FilterConfig filterConfig) throws ServletException {

        }

        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
                throws IOException, ServletException {
            request.setAttribute(passKey, passValue);
            chain.doFilter(request, response);
        }

        @Override
        public void destroy() {

        }
    }
}

Can it handle multiple (hundreds) of requests at the same time without clashing the value of the attribute? — Aakash Sharma, Jan 06 '22 at 18:32

score 7 · Answer 3 · answered Jan 13 '20 at 10:06

An addition to wcong's answer. Since Spring 4.3 after setting the attribute by using request.setAttribute(passKey, passValue);, you can access the attribute in your controller by simply annotating it with @RequestAttribute.

ex.

@RequestMapping("/")
public String index(@RequestAttribute passKey) {
    return (String) passKey;
}

score 3 · Answer 4 · edited May 23 '17 at 12:09

I dont know actually what is the scenario but If you really want to create an object in a filter and then use it somewhere in the code then you may use ThreadLocal class to do so.

To get know how this work see the most voted answer from that question Purpose of ThreadLocal?

In general using ThreadLocal you will be able to create a class that can store objects available ONLY for the current thread.

Sometimes for optimization reasons the same thread can be used to serve subsequent request as well so it will be nice to clean the threadLocal value after the request is processed.

class MyObjectStorage {
  static private ThreadLocal threadLocal = new ThreadLocal<MyObject>();

  static ThreadLocal<MyObject> getThreadLocal() {
    return threadLocal;
  }
}

in the filter

MyObjectStorage.getThreadLocal().set(myObject);

and in the Controller

MyObjectStorage.getThreadLocal().get();

Instead of filter you can use also @ControllerAdvice and pass objects to specified Controllers by using model.

@ControllerAdvice(assignableTypes={MyController.class})
class AddMyObjectAdvice {

    // if you need request parameters
    private @Inject HttpServletRequest request; 

    @ModelAttribute
    public void addAttributes(Model model) {
        model.addAttribute("myObject", myObject);
    }
}


@Controller
public class MyController{

   @RequestMapping(value = "/anyMethod", method = RequestMethod.POST)
   public String anyMethod(Model model) {
      MyObjecte myObject = model.getAttribute("myObject");

      return "result";
   }
}

Usingt thread local isn't a very good practice https://plumbr.io/blog/locked-threads/how-to-shoot-yourself-in-foot-with-threadlocals — Vinz243, Nov 19 '19 at 15:01

Spring: how to pass objects from filters to controllers

4 Answers4

Linked