[ https://issues.jboss.org/browse/ELY-1525?page=com.atlassian.jira.plugin.s... ] Darran Lofthouse commented on ELY-1525: --------------------------------------- Thinking about this further we may need to revisit how mechanisms are obtaining their request parameters - we only make use of this FormDataParser if a mechanism requires the parameters the majority of our mechanisms however only use headers so don't use the parameters. Our FORM implementation only kicks in if a submission to j_security_check is detected so in that case it is correct we completely take over the parsing of the input stream. The Keycloak case I believe is slightly different, I suspect it does need access to request parameters but I think the question is does it really need access to the multi part submission data in the same way a POST submission for FORM authentication would? [~pcraveiro] Do you have any thoughts on the parameter handling requirements? Another consideration is is there a way for us to read the input stream but then reset it for subsequent servlets to be able to read it. I think avoid reading unnecessarily is the better option but the reset if possible may be one solution. -- This message was sent by Atlassian Jira (v7.12.1#712002)