CODEWITHSUNDEEP
javahttpservletsheaderrequest
Ging3r
Ging3r

Reputation: 2136

Custom headers in request with HttpServletRequestWrapper don't appear in client side

I want add a custom header into Servlet request.

At first, I have built a HttpServletRequestWrapper class

public class HeaderRequest_DEBUG extends HttpServletRequestWrapper {

    private static final String DEBUG_NAME="Authorization";
    private static final String DEBUG_VALUE="foccalabindella";

    public HeaderRequest_DEBUG(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String getHeader(String name) {
        if(name.equalsIgnoreCase(HeaderRequest_DEBUG.DEBUG_NAME)){
            return HeaderRequest_DEBUG.DEBUG_VALUE;
        }
        return super.getHeader(name);
    }


    @Override
    public Enumeration getHeaderNames() {
        //create an enumeration of the request headers

        //create a list
        List list = new ArrayList();

        //loop over request headers from wrapped request object
        HttpServletRequest request = (HttpServletRequest)getRequest();
        Enumeration e = request.getHeaderNames();
        while(e.hasMoreElements()) {
            //add the names of the request headers into the list
            String n = (String)e.nextElement();
            list.add(n);
        }

        list.add(HeaderRequest_DEBUG.DEBUG_NAME);

        //create an enumeration from the list and return
        Enumeration en = Collections.enumeration(list);
        return en;
    }

}

So, I've built a Fileter to wrap the standard request:

public class Filter_DEBUG implements Filter{


    @Override public void init(FilterConfig config) throws ServletException {}
    @Override public void destroy() {}

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {

        //if the ServletRequest is an instance of HttpServletRequest
        if(servletRequest instanceof HttpServletRequest) {
            //cast the object
            HttpServletRequest httpServletRequest = (HttpServletRequest)servletRequest;
            //create the FakeHeadersRequest object to wrap the HttpServletRequest
            HeaderRequest_DEBUG request = new HeaderRequest_DEBUG(httpServletRequest);
            //continue on in the filter chain with the FakeHeaderRequest and ServletResponse objects
            filterChain.doFilter(request, servletResponse);
        } else {
            //otherwise, continue on in the chain with the ServletRequest and ServletResponse objects
            filterChain.doFilter(servletRequest, servletResponse);
        }      
    }
}

At last, I've built a page for test:

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
    <head>

    <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
    <title>Initial page</title>
    </head>
    <body>
         header: <%=request.getHeader("Authorization")%>
    </body>
</html>

So, with Firefox/Firebug I have this situation: in the browser window I have this message:

header: foccalabindella

But in Firebug I didn't see that header:

GET /myServer/jsp/welcome.jsp HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=465C24CC9A113E270F72829E35155BBB
Connection: keep-alive

To confirm this, if I add a submit button and I read request in a servlet, I haven't that header

Upvotes: 2

Views: 4647

Answers (1)

BalusC
BalusC

Reputation: 1108722

Of course it doesn't show up in Firebug. It wasn't the browser who has set that header. It was your own code in the server side who did that after having received the request from the browser. Any changes made to that request in the server side in order to fool the remaining of the server side code in the stack that the browser has sent it won't be reflected back in the original request which the browser made. All which the browser retrieves back is the HTTP response. There's no way to change the initial HTTP request from the HTTP response on.

Whatever functional requirement you've in mind for which you thought that this is the right solution needs most likely to be solved differently.

Upvotes: 3

Related Questions