Are the @MultipartConfig configuration elements in a Servlet useless in presence of a Filter?

Question

I've alredy configured a servlet like this:

@WebServlet(name = "TestServlet", urlPatterns = {"/test"})
@MultipartConfig(location = "C://test",
                 fileSizeThreshold=1024*1024*10,    // 10 MB
                 maxFileSize=1024*1024*50,          // 50 MB
                 maxRequestSize=1024*1024*100)      // 100 MB
public class TestServlet extends HttpServlet {

However I'm not sure if the fileSize and requestSize "security limits" become useless when a Filter processes the request before the servlet (I read somewhere that the filter request processing is not necessarily before the resources, I might be wrong on this).

The filter configuration is simple enough:

@WebFilter(filterName = "TestFilter",
           description = "TheTestFilter",
           urlPatterns = { "*.any" })
public class TestController implements Filter {

The filter implementation will contain stateless security credentials validation.

Thanks for the interest!

Regards.

Answer 1

Well, I guess it was a silly question. The trick here is how the ServletRequest object in the filter is being handled. As long as I don't do the mistake of trying to read the request body with getInputStream() or getReader(), the MultipartConfig options should work as expected. Somehow I remebered running into this few years ago by trying to get into the message body instead of transfering control to another web component.

Here's some documentation.