这是获取HttpContext请求正文的安全方法吗

Question

public static class HttpRequestHelper
{
    public static string RequestBody()
    {
        var bodyStream = new StreamReader(HttpContext.Current.Request.InputStream);
        bodyStream.BaseStream.Seek(0, SeekOrigin.Begin);
        var bodyText = bodyStream.ReadToEnd();
        return bodyText;
    }
}

I plan to call this from ActionFilters to log incoming requests. Of course there could be multiple simultaneous requests.

Is this approach ok?

Answer 1

Is your question from the perspective of concurrency or ASP.NET Web API in general? Every request has its own context and you are okay with multiple requests going on in parallel. But here are two things for you to look at.

(1) Since you are using HttpContext , you are locking yourself to web hosting (IIS), which in many cases should be okay. But I would like you to be aware of this.

(2) Your code HttpRequestHelper.RequestBody() will work when called from an action filter, as you mentioned. However, if you try to call this from other places, say a message handler, this will not work. When I say this will not work, parameter binding that binds request body to action method parameter will not work. You will need to seek to the beginning once you are done. The reason it works from action filter is that binding would have already happened by the time action filter runs in the pipeline. This is another thing you might need to be aware of.

Answer 2

I've needed use InputStream of Http Request. I have a WebApp and IOS App that navigates to a aspx page, if the url request contains some parameters i read the information in database and if i not find any parameters in url request i read the request body and i work fine !

        protected void Page_Load(object sender, EventArgs e)
        {
            try
            {
                if (string.IsNullOrEmpty(Request.QueryString["AdHoc"]) == false)
                {



                       string v_AdHocParam = Request.QueryString["AdHoc"];
                        string [] v_ListParam = v_AdHocParam.Split(new char[] {','});

                        if (v_ListParam.Length < 2)
        {


                   DataContractJsonSerializer jsonSerializer = new DataContractJsonSerializer(typeof(WS_DemandeIntervention));
                    WS_DemandeIntervention response = (WS_DemandeIntervention)jsonSerializer.ReadObject(Request.InputStream);
....
}


   if (string.IsNullOrEmpty(Request.QueryString["IdBonDeCommande"])==false)

                    {
    ....