framework icon indicating copy to clipboard operation
framework copied to clipboard

Non-POST request body with type multipart/form-data is not present

Open sbbjss opened this issue 8 months ago • 3 comments

Laravel Version

12.3.0

PHP Version

8.4.5

Database Driver & Version

No response

Description

Non-POST multipart/form-data requests don't have request body data present unless POST request with _method override is used. This extends on closed issue #13457.

This limitation was recently addressed in PHP 8.4 by including request_parse_body() function, which allows parsing multipart/form-data content for PUT/PATCH requests.

It would be great if Laravel could implement support for this new PHP 8.4 feature. Working middleware example below:

class HandlePutFormData
{
    public function handle(Request $request, Closure $next)
    {
        if (($request->isMethod('PUT') || $request->isMethod('PATCH')) &&
            str_contains($request->header('Content-Type'), 'multipart/form-data')) {

            $requestWithParsedBody = $request;

            try {
                [$post, $files] = request_parse_body();

                foreach ($post as $key => $value) {
                    $requestWithParsedBody->merge([$key => $value]);
                }

                foreach ($files as $key => $file) {
                    $requestWithParsedBody->files->set($key, $file);
                }

            } catch (RequestParseBodyException $e) {
                Log::error('HandlePutFormData::handle, failed to parse request body: ' . $e->getMessage());
                return $next($request);
            }

            return $next($requestWithParsedBody);
        }

        return $next($request);
    }
}

Steps To Reproduce

  1. Create endpoint accepting PUT, PATCH or DELETE requests:
Route::put('/test-endpoint', function (Request $request) {
    return $request->all();
});
  1. Send a request:
curl -X PUT -H "Content-Type: multipart/form-data" -F "name=test" -F "[email protected]" http://localhost:8000/test-endpoint
  1. Observe form fields nor files are accessible in request object.

sbbjss avatar Mar 26 '25 15:03 sbbjss