Configure HiddenHttpMethodFilter for Spring WebFlux

Closes gh-14008

Author: artsiom

spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfiguration.java

@@ -41,6 +41,7 @@
 import org.springframework.boot.autoconfigure.web.format.WebConversionService;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.boot.web.codec.CodecCustomizer;
+import org.springframework.boot.web.reactive.filter.OrderedHiddenHttpMethodFilter;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
@@ -55,6 +56,7 @@
 import org.springframework.http.codec.ServerCodecConfigurer;
 import org.springframework.util.ClassUtils;
 import org.springframework.validation.Validator;
+import org.springframework.web.filter.reactive.HiddenHttpMethodFilter;
 import org.springframework.web.reactive.config.DelegatingWebFluxConfiguration;
 import org.springframework.web.reactive.config.EnableWebFlux;
 import org.springframework.web.reactive.config.ResourceChainRegistration;
@@ -80,6 +82,7 @@
  * @author Andy Wilkinson
  * @author Phillip Webb
  * @author Eddú Meléndez
+ * @author Artsiom Yudovin
  * @since 2.0.0
  */
 @Configuration
@@ -91,6 +94,12 @@
 @AutoConfigureOrder(Ordered.HIGHEST_PRECEDENCE + 10)
 public class WebFluxAutoConfiguration {
 
+	@Bean
+	@ConditionalOnMissingBean(HiddenHttpMethodFilter.class)
+	public OrderedHiddenHttpMethodFilter hiddenHttpMethodFilter() {
+		return new OrderedHiddenHttpMethodFilter();
+	}
+
 	@Configuration
 	@EnableConfigurationProperties({ ResourceProperties.class, WebFluxProperties.class })
 	@Import({ EnableWebFluxConfiguration.class })

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java

@@ -30,6 +30,7 @@
 import org.springframework.boot.autoconfigure.validation.ValidatorAdapter;
 import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
 import org.springframework.boot.web.codec.CodecCustomizer;
+import org.springframework.boot.web.reactive.filter.OrderedHiddenHttpMethodFilter;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.Ordered;
@@ -41,6 +42,7 @@
 import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.validation.Validator;
 import org.springframework.validation.beanvalidation.LocalValidatorFactoryBean;
+import org.springframework.web.filter.reactive.HiddenHttpMethodFilter;
 import org.springframework.web.reactive.HandlerMapping;
 import org.springframework.web.reactive.accept.RequestedContentTypeResolver;
 import org.springframework.web.reactive.config.WebFluxConfigurationSupport;
@@ -66,6 +68,7 @@
  *
  * @author Brian Clozel
  * @author Andy Wilkinson
+ * @author Artsiom Yudovin
  */
 public class WebFluxAutoConfigurationTests {
 
@@ -351,6 +354,22 @@ public void validatorWithCustomJsr303ValidatorExposedAsSpringValidator() {
 				});
 	}
 
+	@Test
+	public void hiddenHttpMethodFilterIsAutoConfigured() {
+		this.contextRunner.run((context) -> assertThat(context)
+				.hasSingleBean(OrderedHiddenHttpMethodFilter.class));
+	}
+
+	@Test
+	public void hiddenHttpMethodFilterCanBeOverridden() {
+		this.contextRunner.withUserConfiguration(CustomHiddenHttpMethodFilter.class)
+				.run((context) -> {
+					assertThat(context)
+							.doesNotHaveBean(OrderedHiddenHttpMethodFilter.class);
+					assertThat(context).hasSingleBean(HiddenHttpMethodFilter.class);
+				});
+	}
+
 	@Configuration
 	protected static class CustomArgumentResolvers {
 
@@ -456,4 +475,14 @@ public Validator customValidator() {
 
 	}
 
+	@Configuration
+	static class CustomHiddenHttpMethodFilter {
+
+		@Bean
+		public HiddenHttpMethodFilter customHiddenHttpMethodFilter() {
+			return mock(HiddenHttpMethodFilter.class);
+		}
+
+	}
+
 }

spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/reactive/filter/OrderedHiddenHttpMethodFilter.java

@@ -0,0 +1,53 @@
+/*
+ * Copyright 2012-2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.web.reactive.filter;
+
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.core.Ordered;
+import org.springframework.web.filter.reactive.HiddenHttpMethodFilter;
+
+/**
+ * {@link HiddenHttpMethodFilter} that also implements {@link Ordered}.
+ *
+ * @author Artsiom Yudovin
+ * @since 2.0.5
+ */
+public class OrderedHiddenHttpMethodFilter extends HiddenHttpMethodFilter
+		implements Ordered {
+
+	/**
+	 * The default order is high to ensure the filter is applied before Spring Security.
+	 */
+	public static final int DEFAULT_ORDER = FilterRegistrationBean.REQUEST_WRAPPER_FILTER_MAX_ORDER
+			- 10000;
+
+	private int order = DEFAULT_ORDER;
+
+	@Override
+	public int getOrder() {
+		return this.order;
+	}
+
+	/**
+	 * Set the order for this filter.
+	 * @param order the order to set
+	 */
+	public void setOrder(int order) {
+		this.order = order;
+	}
+
+}