how servlets obtain headers

[Madhur Ahuja]

Hello

While studying servlets, I noticed the function,
HttpServletRequest.getHeaderNames() which successfully retreived
all the headers passed by my browser.

However I noticed that, when I run my servlet behind a local proxy,
the servlet was unable to return any headers, i.e. it returned
null although the web page was corretly displayed.

How is this possible, since every page requested from the server has
a header and browser like I.E. expect to receive some minimum headers.

Here is the program:

import javax.servlet.*;
import java.io.*;
import javax.servlet.http.*;
import java.util.*;
file://see getheader.html for extension
public class GetHeader extends HttpServlet
{

public void doGet(HttpServletRequest hrq,HttpServletResponse hrp)
throws ServletException,IOException
{
InputStream is=hrq.getInputStream();
PrintWriter pw=hrp.getWriter();
hrp.setContentType("text/html");

getit(hrq,hrp,pw);
pw.println("</body>");
pw.close();
is.close();


}

public void doPost(HttpServletRequest hrq,HttpServletResponse hrp)
throws ServletException,IOException
{
doGet(hrq,hrp);
}

void getit(HttpServletRequest hrq,HttpServletResponse hrp,PrintWriter pw)
{

Enumeration headers=hrq.getHeaderNames();
while(headers.hasMoreElements())
{
String head=(String)headers.nextElement();
pw.println(head+hrq.getHeader(head));
pw.println("<br>");
}


}
}

 

[John C. Bollinger]

Hello

While studying servlets, I noticed the function,
HttpServletRequest.getHeaderNames() which successfully retreived
all the headers passed by my browser.

However I noticed that, when I run my servlet behind a local proxy,
the servlet was unable to return any headers, i.e. it returned
null although the web page was corretly displayed.

How is this possible, since every page requested from the server has
a header and browser like I.E. expect to receive some minimum headers.

(1) You are getting confused between the headers on the request message
(which your servlet will display) and the headers on the response
message (which are interpreted by your browser). The two groups of
headers are independent.

(2) A proxy is entirely capable of stripping headers from messages. It
may conceivably do so only for traffic passing in one direction. It may
strip some headers but not others. I cannot possibly divine the details
of how your particular proxy is configured.

(3) I.E. may work with fewer headers than you think. I'm not up to
speed on which headers, if any, it requires, so which do *you* say they are?

(4) If you are curious about the HTTP traffic received at the user agent
end of an HTTP transaction, then you are much better off capturing the
messages and analyzing them directly. Inferring the headers from
browser behavior is very unreliable.


John Bollinger
(e-mail address removed)

 

[Madhur Ahuja]

(1) You are getting confused between the headers on the request
message (which your servlet will display) and the headers on the
response
message (which are interpreted by your browser). The two groups of
headers are independent.

Although I am not confused but after re-reading my post, I am sure
others would have got confused. Let me explain clearly. Here I am
talking about only request headers. A servlet is capable of displaying
*all* the request headers(which invoke the servlet) through
getHeaderNames().

However when I am behind the proxy, the servlet displays none of the
headers.

(2) A proxy is entirely capable of stripping headers from messages.
It
may conceivably do so only for traffic passing in one direction. It
may strip some headers but not others. I cannot possibly divine the
details
of how your particular proxy is configured.

I know a proxy implementation can change the headers in between.
However headers like *content-type* must always be present.

The most strange thing is that, the proxy is none other but coded by
myself in Java. And I know that my proxy, is passing headers.

 

[Owen Jacobson]

Although I am not confused but after re-reading my post, I am sure
others would have got confused. Let me explain clearly. Here I am
talking about only request headers. A servlet is capable of displaying
*all* the request headers(which invoke the servlet) through
getHeaderNames().

However when I am behind the proxy, the servlet displays none of the
headers.

Have you checked that neither your user agent nor your proxy are caching
the response?

I know a proxy implementation can change the headers in between.
However headers like *content-type* must always be present.

The Content-Type header is not normally a request header; it is a response
header. There are related headers. From RFC 2616:

request-header = Accept ; Section 14.1
| Accept-Charset ; Section 14.2
| Accept-Encoding ; Section 14.3
| Accept-Language ; Section 14.4
| Authorization ; Section 14.8
| Expect ; Section 14.20
| From ; Section 14.22
| Host ; Section 14.23
| If-Match ; Section 14.24
| If-Modified-Since ; Section 14.25
| If-None-Match ; Section 14.26
| If-Range ; Section 14.27
| If-Unmodified-Since ; Section 14.28
| Max-Forwards ; Section 14.31
| Proxy-Authorization ; Section 14.34
| Range ; Section 14.35
| Referer ; Section 14.36
| TE ; Section 14.39
| User-Agent ; Section 14.43

With HTTP/1.1, only one of these is mandatory: Host. Even so, most HTTP
daemons, for compatability with HTTP/1.0, will permit requests with no
Host header using default value of that header for the server.

The most strange thing is that, the proxy is none other but coded by
myself in Java. And I know that my proxy, is passing headers.

Are you sure? Have you watched traffic flowing in and out of your proxy
with another tool, such as tcpdump or ethereal? Have you tried
configuring your web server to log headers itself?

 

[John C. Bollinger]

Although I am not confused but after re-reading my post, I am sure
others would have got confused. Let me explain clearly. Here I am
talking about only request headers. A servlet is capable of displaying
*all* the request headers(which invoke the servlet) through
getHeaderNames().

However when I am behind the proxy, the servlet displays none of the
headers.

Very well.

I know a proxy implementation can change the headers in between.
However headers like *content-type* must always be present.

You _do_ seem to be confused about request and response headers, but
perhaps in a different way than I thought before.

The most strange thing is that, the proxy is none other but coded by
myself in Java. And I know that my proxy, is passing headers.

Your test servlet seems to indicate otherwise. I know no reason why a
servlet container would handle a request forwarded by a proxy
differently than an otherwise identical request sent directly by the client.

The most likely scenario, especially considering that the proxy is
home-built, is that the requests are *not* identical. One possibility
is that the proxy may be mangling the request headers -- that is, it may
be including the names and values, but getting the message syntax wrong.
For instance, all it would need to do is insert an extra CR LF after
the start line, and all the "headers" would become part of the message
body. Or if your proxy is terminating header fields and/or the start
line with just LF instead of CR LF (not too unlikely in a naive
implementation on a Unix-like system) then the resulting messages are
not syntactically correct.


John Bollinger
(e-mail address removed)

 

[Madhur Ahuja]

Very well.


You _do_ seem to be confused about request and response headers, but
perhaps in a different way than I thought before.


Your test servlet seems to indicate otherwise. I know no reason why a
servlet container would handle a request forwarded by a proxy
differently than an otherwise identical request sent directly by the
client.

The most likely scenario, especially considering that the proxy is
home-built, is that the requests are *not* identical. One possibility
is that the proxy may be mangling the request headers -- that is, it
may
be including the names and values, but getting the message syntax
wrong. For instance, all it would need to do is insert an extra CR
LF after
the start line, and all the "headers" would become part of the message
body. Or if your proxy is terminating header fields and/or the start
line with just LF instead of CR LF (not too unlikely in a naive
implementation on a Unix-like system) then the resulting messages are
not syntactically correct.

Oops! Sorry, I did get confused between request and response header. In
my own coded proxy, I was only passing GET header and ignoring all others.

I tried and added manually some headers after GET and they were displayed
by the browser

Thanks for the help.