Merge pull request #4017 from spring-cloud/place-attributes-on-unwrapped-request

Unwrap request to put attributes on underlying request

Author: ryanjbaxter

spring-cloud-gateway-server-webmvc/src/main/java/org/springframework/cloud/gateway/server/mvc/common/MvcUtils.java

@@ -34,6 +34,8 @@
 import java.util.Objects;
 import java.util.Optional;
 
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequestWrapper;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.jspecify.annotations.Nullable;
@@ -123,6 +125,21 @@ public static <T> Optional<T> cacheAndReadBody(ServerRequest request, Class<T> t
 		return readBody(request, rawBody, toClass);
 	}
 
+	/**
+	 * Unwraps an HttpServletRequest to get to the innermost request. This is necessary to
+	 * ensure attributes are set on the actual request object rather than on wrapper
+	 * instances that may not propagate attribute changes.
+	 * @param request the request to unwrap
+	 * @return the innermost HttpServletRequest
+	 */
+	private static HttpServletRequest unwrapRequest(HttpServletRequest request) {
+		HttpServletRequest unwrapped = request;
+		while (unwrapped instanceof HttpServletRequestWrapper wrapper) {
+			unwrapped = (HttpServletRequest) wrapper.getRequest();
+		}
+		return unwrapped;
+	}
+
 	public static ByteArrayInputStream cacheBody(ServerRequest request) {
 		try {
 			byte[] bytes = StreamUtils.copyToByteArray(request.servletRequest().getInputStream());
@@ -187,7 +204,12 @@ public static ApplicationContext getApplicationContext(ServerRequest request) {
 		if (request.attributes().containsKey(key)) {
 			return (T) request.attributes().get(key);
 		}
-		return (T) getGatewayAttributes(request).get(key);
+		T gatewayAttr = (T) getGatewayAttributes(request).get(key);
+		if (gatewayAttr != null) {
+			return gatewayAttr;
+		}
+		// Fallback to servlet request attributes for compatibility with request wrappers
+		return (T) request.servletRequest().getAttribute(key);
 	}
 
 	@SuppressWarnings("unchecked")
@@ -211,13 +233,18 @@ public static Map<String, Object> getUriTemplateVariables(ServerRequest request)
 	}
 
 	public static void putAttribute(ServerRequest request, String key, @Nullable Object value) {
+		// Also set on the unwrapped servlet request to ensure persistence through
+		// wrappers like Spring's AttributesPreservingRequest
+		HttpServletRequest unwrapped = unwrapRequest((HttpServletRequest) request.servletRequest());
 		if (value == null) {
 			request.attributes().remove(key);
 			getGatewayAttributes(request).remove(key);
+			unwrapped.removeAttribute(key);
 		}
 		else {
 			request.attributes().put(key, value);
 			getGatewayAttributes(request).put(key, value);
+			unwrapped.setAttribute(key, value);
 		}
 
 	}

spring-cloud-gateway-server-webmvc/src/test/java/org/springframework/cloud/gateway/server/mvc/ServerMvcIntegrationTests.java

@@ -65,7 +65,6 @@
 import org.springframework.cloud.loadbalancer.annotation.LoadBalancerClient;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
-import org.springframework.context.annotation.Lazy;
 import org.springframework.core.Ordered;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.http.HttpEntity;
@@ -90,7 +89,6 @@
 import org.springframework.web.servlet.function.RouterFunction;
 import org.springframework.web.servlet.function.ServerRequest;
 import org.springframework.web.servlet.function.ServerResponse;
-import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.springframework.cloud.gateway.server.mvc.filter.AfterFilterFunctions.DedupeStrategy.RETAIN_FIRST;
@@ -1048,26 +1046,6 @@ EventController eventController() {
 			return new EventController();
 		}
 
-		// TODO This is needed to work around
-		// https://github.com/spring-cloud/spring-cloud-gateway/issues/3816
-		// which results from Spring Security being on the classpath. Once we can address
-		// this issue we should
-		// remove this bean and no longer extend WebMvcConfigurationSupport in this
-		// configuration class
-		@Bean
-		@Lazy
-		@Override
-		public HandlerMappingIntrospector mvcHandlerMappingIntrospector() {
-			return new HandlerMappingIntrospector() {
-				@Override
-				public Filter createCacheFilter() {
-					return (request, response, chain) -> {
-						chain.doFilter(request, response);
-					};
-				}
-			};
-		}
-
 		@Bean
 		public AsyncProxyManager<String> caffeineProxyManager() {
 			Caffeine<String, RemoteBucketState> builder = (Caffeine) Caffeine.newBuilder().maximumSize(100);