title: Spring Security & Multipart requests
body: <p>I have a @Controller protected with Spring Security and OAuth2 in which I am trying to let my users upload a file:</p>
  
  <pre><code>@Controller
  @RequestMapping(value = "/api/image")
  public class ImageController {
  
      @PreAuthorize("hasAuthority('ROLE_USER')")
      @RequestMapping(value = "/upload", method = RequestMethod.PUT)
      public @ResponseBody Account putImage(@RequestParam("title") String title, MultipartHttpServletRequest request, Principal principal){
          // Some type of file processing...
          System.out.println("-------------------------------------------");
          System.out.println("Test upload: " + title);
          System.out.println("Test upload: " + request.getFile("file").getOriginalFilename());
          System.out.println("-------------------------------------------");
  
          return ((Account) ((OAuth2Authentication) principal).getPrincipal());
      }
  }
  </code></pre>
  
  <p>When I try to upload a file and title, I get the following exception. I am setting the Content-Type header to multipart/form-data.</p>
  
  <pre><code>java.lang.IllegalStateException: Current request is not of type [org.springframework.web.multipart.MultipartHttpServletRequest]: SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.connector.RequestFacade@1aee75b7]]
      at org.springframework.web.servlet.mvc.method.annotation.ServletRequestMethodArgumentResolver.resolveArgument(ServletRequestMethodArgumentResolver.java:84)
      at org.springframework.web.method.support.HandlerMethodArgumentResolverComposite.resolveArgument(HandlerMethodArgumentResolverComposite.java:75)
      at org.springframework.web.method.support.InvocableHandlerMethod.getMethodArgumentValues(InvocableHandlerMethod.java:156)
      at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:117)
  </code></pre>
  
  <p>How can I do file uploads behind Spring Security? It seems like the request never gets turned into a MultiPartHttpServerRequest and so it doesn't work?</p>
  
  <p>If I change my method signature to take a @RequestParam MultipartFile, then I get an exception like:</p>
  
  <pre><code>DEBUG DefaultListableBeanFactory - Returning cached instance of singleton bean 'imageController'
  DEBUG ExceptionHandlerExceptionResolver - Resolving exception from handler [public com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage(java.lang.String,org.springframework.web.multipart.MultipartFile,java.security.Principal)]: java.lang.IllegalArgumentException: Expected MultipartHttpServletRequest: is a MultipartResolver configured?
  DEBUG ResponseStatusExceptionResolver - Resolving exception from handler [public com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage(java.lang.String,org.springframework.web.multipart.MultipartFile,java.security.Principal)]: java.lang.IllegalArgumentException: Expected MultipartHttpServletRequest: is a MultipartResolver configured?
  DEBUG DefaultHandlerExceptionResolver - Resolving exception from handler [public com.tinsel.server.model.Account com.tinsel.server.controller.ImageController.putImage(java.lang.String,org.springframework.web.multipart.MultipartFile,java.security.Principal)]: java.lang.IllegalArgumentException: Expected MultipartHttpServletRequest: is a MultipartResolver configured?
  DEBUG DispatcherServlet - Could not complete request
  java.lang.IllegalArgumentException: Expected MultipartHttpServletRequest: is a MultipartResolver configured?
      at org.springframework.util.Assert.notNull(Assert.java:112)
  </code></pre>
  
  <p>...but I do have a MultipartResolver configured in my XML:</p>
  
  <pre><code>&lt;bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver"&gt;
      &lt;property name="maxUploadSize" value="268435456"/&gt; &lt;!-- 256 megs --&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>I did see <a href="http://www.adamweigold.com/2012/01/using-multpartrequestresolvers-with.html" rel="noreferrer">this blog post about getting this working under Spring 3.0</a> - but I'm trying to stay more up to date and am using 3.1 currently. Is there perhaps an updated fix?</p>