once the response is committed we can't set the header. you have used flushBuffer() which commits the response which forces any content in the buffer to be written to the client. A call to this method automatically commits the response, meaning the status code and headers will be written.
Do all headers have to be sent before the response body is sent?
Of course - at the TCP/IP level, the response is just a single stream of characters sent to the browser. The servlet API keeps the headers separate from the output buffer until the first buffer flush, but after that the headers have been written. Bill