Prevents access to request raw data in Flask

This all seems to be a bit of a mess, but if you want to access the raw request data in Flask regardless of the content type (I can’t control the client), you need to call

 request.get_data()

and you need to do this before accessing request.data or request.form, because both of these will call get_data() in such a way that the stream will be exhausted, parsed into the form dict, and the raw data is never cached.

This doesn’t seem documented except in the comments: https://github.com/mitsuhiko/werkzeug/blob/master/werkzeug/wrappers.py#L440

Should the sentry extension call request.get_data() first to make sure the raw data is cached before using request.form?

[groveriffic]

I’ve run into this issue also recently.

It makes sense that Flask doesn’t want to cache the unparsed body. This could be really large in the case of file uploads. Triggering the caching is probably not best for all scenarios.

This is working for me right now

# Workaround to allow unparsed request body to be be read from cache
# This is required to validate a signature on webhooks
# This MUST go before Sentry integration as sentry triggers form parsing
@app.before_request
def enable_form_raw_cache():
  if request.path.startswith('/redacted'):
    if request.content_length > 1024 * 1024:  # 1mb
      abort(413)  # Payload too large
    request.get_data(parse_form_data=False, cache=True)

if config.SENTRY_DSN:
  sentry = Sentry(app, dsn=config.SENTRY_DSN, logging=True, level=logging.ERROR)

There might still be a better, more general solution. I’m not sure if the code that captures request.form could just be moved into an after_request and still have the same results?

[mitsuhiko]

For what it’s worth the new sentry-python SDK makes this configurable and generally is less invasive for accessing this information.