HttpServletRequest - catch duplicate request header names

[aries dimagiba]

I am running into a problem with HttpServletRequest. I have an application in which it is to retrieve request headers. If the application finds duplicate header names, it's supposed to throw an error. However, after a bit of Googling, I found out that HttpServletRequest ignores duplicate header names, and proceeds with getting the first header name it encounters. Is there anything I can do to catch those duplicate request headers?

I'm using Tomcat 6 as the application container.

This is the code:

int headerChecker=0;
for(Enumeration<String>names = request.getHeaderNames(); names.hasMoreElements(); ) {
    String name = (String)names.nextElement();
    for(Enumeration<String>values = request.getHeaders(name); values.hasMoreElements(); ) {
        String value=(String)values.nextElement();
         if(name.equalsIgnoreCase("abcd")){
        headerChecker++; // add 1 to headerChecker if abcd header is encountered
         }
        System.out.println("name: "+name+"\tvalue: "+value);
        }
    }

    if(headerChecker! = 1){
        logger.error("abcd is duplicated, returning HTTP 404");
    } else {
        //...proceed with application
    }
}

Attached was test screenshot using RESTClient:
This is the log:

name: host value: localhost:8080
name: user-agent value: CocoaRestClient/8 CFNetwork/520.4.3 Darwin/11.4.2 (x86_64)(MacBookPro9%2C2)
name: content-length value: 23
name: accept value:
name: abcd value: 1234556
name: accept-language value: en-us
name: accept-encoding value: gzip, deflate
name: content-type value:
application/x-www-form-urlencoded
name: connection value: keep-alive

As you can see, only the first occurence of "abcd" has been caught and the other one was discarded. Hope somebody can lend me a hand on this. Thank you very much

This is the sample servlet so that you can replicate the problem I am having.

public class HeaderServlet extends HttpServlet
{
public void doPost(HttpServletRequest req, HttpServletResponse res)
{
    doGet(req, res);
}

public void doGet(HttpServletRequest req, HttpServletResponse res)
{
int headerChecker = 0;
String value = "";  
for(Enumeration<String> names = req.getHeaderNames();names.hasMoreElements();){
    String name = (String) names.nextElement(); 
    Enumeration<String> values = req.getHeaders(name);
    if(values != null)
    {
        while(values.hasMoreElements()) {
            if(name.equalsIgnoreCase("abcd"))
            {
                headerChecker++;
                System.out.println("Checker value: " + headerChecker) ;
            }

            value = (String) values.nextElement();

            System.out.println("header name: " + name + "\theader value: " + value);
        }

    }   
  }
}   
}

[aries dimagiba]

Anyone got an idea? Your help will much appreciated

[Jaikiran Pai]

You have to be patient, it's just been 3 hours since you asked the question and it's a weekend too. If anyone knows the answer they'll reply.

As for the question, I'm not sure what the spec says about duplicate request headers. If those are allowed, then your application probably should consider what it means to have different values for the same header. For example, how do you decide which header value is more appropriate?

[aries dimagiba]

Jaikiran Pai wrote:You have to be patient, it's just been 3 hours since you asked the question and it's a weekend too. If anyone knows the answer they'll reply.

As for the question, I'm not sure what the spec says about duplicate request headers. If those are allowed, then your application probably should consider what it means to have different values for the same header. For example, how do you decide which header value is more appropriate?

Sorry sir for being impatient. As for the specs, duplicate request header names are not allowed and should be handled (such as throwing an error).

[Ulf Dittmer]

aries dimagiba wrote:As for the specs, duplicate request header names are not allowed

That's not correct. According to the HTTP spec,

Multiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list [i.e., #(values)]. It MUST be possible to combine the multiple header fields into one "field-name: field-value" pair, without changing the semantics of the message, by appending each subsequent field-value to the first, each separated by a comma. The order in which header fields with the same field-name are received is therefore significant to the interpretation of the combined field value, and thus a proxy MUST NOT change the order of these field values when a message is forwarded.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2

[Richard Tookey]

The interface ServletRequest deleclares a method

public java.lang.String[] getParameterValues(java.lang.String name)

[aries dimagiba]

Ulf Dittmer wrote:

aries dimagiba wrote:As for the specs, duplicate request header names are not allowed

That's not correct. According to the HTTP spec,

Multiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list [i.e., #(values)]. It MUST be possible to combine the multiple header fields into one "field-name: field-value" pair, without changing the semantics of the message, by appending each subsequent field-value to the first, each separated by a comma. The order in which header fields with the same field-name are received is therefore significant to the interpretation of the combined field value, and thus a proxy MUST NOT change the order of these field values when a message is forwarded.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2

Thanks for the reply Sir. However, what I meant was the specification of the project I am handling.

[aries dimagiba]

Richard Tookey wrote:The interface ServletRequest deleclares a method

public java.lang.String[] getParameterValues(java.lang.String name)

Thanks for the reply Sir. Can I extract the duplicated headers with that method?

[Richard Tookey]

aries dimagiba wrote:

Richard Tookey wrote:The interface ServletRequest deleclares a method

public java.lang.String[] getParameterValues(java.lang.String name)

Thanks for the reply Sir. Can I extract the duplicated headers with that method?

How about reading the Javadoc for the method and then writing a quick test Servlet if you are still not sure.

[aries dimagiba]

Richard Tookey wrote:

How about reading the Javadoc for the method and then writing a quick test Servlet if you are still not sure.

I've tried that Sir but I think that method is concerned only on parameters being passed, not on the request headers.

[Jaikiran Pai]

Please read the text that Ulf has quoted. It clearly explains how those values will be represented, the delimiter and even the order of those values. All you have to do is parse it as per your needs.

[aries dimagiba]

Jaikiran Pai wrote:Please read the text that Ulf has quoted. It clearly explains how those values will be represented, the delimiter and even the order of those values. All you have to do is parse it as per your needs.

I see Sir, however, i dont know how to parse that using Java. Can you show me how? Thanks.

[Richard Tookey]

aries dimagiba wrote:

Richard Tookey wrote:

How about reading the Javadoc for the method and then writing a quick test Servlet if you are still not sure.

I've tried that Sir but I think that method is concerned only on parameters being passed, not on the request headers.

Sorry I misunderstood your requirement. Please ignore everything I posted on this.

[aries dimagiba]

Richard Tookey wrote:

aries dimagiba wrote:

Richard Tookey wrote:

How about reading the Javadoc for the method and then writing a quick test Servlet if you are still not sure.

I've tried that Sir but I think that method is concerned only on parameters being passed, not on the request headers.

Sorry I misunderstood your requirement. Please ignore everything I posted on this.

That's fine Sir, appreciated your effort for this. Thank you very much

[Jaikiran Pai]

aries dimagiba wrote:

Jaikiran Pai wrote:Please read the text that Ulf has quoted. It clearly explains how those values will be represented, the delimiter and even the order of those values. All you have to do is parse it as per your needs.

I see Sir, however, i dont know how to parse that using Java. Can you show me how? Thanks.

I just spent a few seconds to see if there are already available APIs for this. Guess what http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getHeaders%28java.lang.String%29

[aries dimagiba]

Jaikiran Pai wrote:

aries dimagiba wrote:

Jaikiran Pai wrote:Please read the text that Ulf has quoted. It clearly explains how those values will be represented, the delimiter and even the order of those values. All you have to do is parse it as per your needs.

I see Sir, however, i dont know how to parse that using Java. Can you show me how? Thanks.

I just spent a few seconds to see if there are already available APIs for this. Guess what http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getHeaders%28java.lang.String%29

Thank you Sir, but request.getHeaders and request.getHeaderNames() are already present in the code i posted above.

[Jaikiran Pai]

Are you saying the other value for the header name isn't being passed on to your application at all?

[aries dimagiba]

Jaikiran Pai wrote:Are you saying the other value for the header name isn't being passed on to your application at all?

Yes Sir.

[Jaikiran Pai]

How are those duplicates headers being added?

[Jaikiran Pai]

By the way, you asked the same question here http://stackoverflow.com/questions/12652182/catching-duplicate-request-headers-with-httpservletrequest which is fine, but when asking the same question in multiple different forums, please do let others know about it.

[aries dimagiba]

Jaikiran Pai wrote:How are those duplicates headers being added?

Jaikiran Pai wrote:By the way, you asked the same question here http://stackoverflow.com/questions/12652182/catching-duplicate-request-headers-with-httpservletrequest which is fine, but when asking the same question in multiple different forums, please do let others know about it.

Indeed Sir Jaikiran, just to gather more information regarding my problem. Yes, I'll do that asap. To answer your question, I add the duplicate headers using an app called Cocoa RESTClient for testing my application.

[Jaikiran Pai]

I just did a quick test with my local Tomcat installation and used curl as the client to send those duplicate headers. It worked fine. The server side (Tomcat) application received those duplicate headers and printed both the values. It's the same code as yours:

System.out.println("Printing headers:");
for(Enumeration<String>names = request.getHeaderNames(); names.hasMoreElements(); ) {  
    String name = (String)names.nextElement();  
    for(Enumeration<String>values = request.getHeaders(name); values.hasMoreElements(); ) {  
        String value=(String)values.nextElement();  
        System.out.println("Header name: "+name+"\t header value: "+value);  

    }  
}  

The curl client invocation was:

curl --header "foo:bar" --header "abc:xyz" --header "foo:baragain" http://localhost:8080/myapp/dumpHeaders

The output was:

Printing headers:

Header name: host header value: localhost:8080
Header name: accept header value: */*
Header name: foo header value: bar
Header name: foo header value: baragain
Header name: abc header value: xyz

As you can see the "foo" header was received with 2 different values. So I believe this isn't a Tomcat issue. I'm on Tomcat 5.5.x by the way. You'll have to check with the cocoa-rest-client to make sure the headers are indeed being passed with different values.

[aries dimagiba]

Jaikiran Pai wrote:I just did a quick test with my local Tomcat installation and used curl as the client to send those duplicate headers. It worked fine. The server side (Tomcat) application received those duplicate headers and printed both the values. It's the same code as yours:

System.out.println("Printing headers:");
for(Enumeration<String>names = request.getHeaderNames(); names.hasMoreElements(); ) {  
    String name = (String)names.nextElement();  
    for(Enumeration<String>values = request.getHeaders(name); values.hasMoreElements(); ) {  
        String value=(String)values.nextElement();  
        System.out.println("Header name: "+name+"\t header value: "+value);  

    }  
}  

The curl client invocation was:

curl --header "foo:bar" --header "abc:xyz" --header "foo:baragain" http://localhost:8080/myapp/dumpHeaders

The output was:

Printing headers:

Header name: host header value: localhost:8080
Header name: accept header value: */*
Header name: foo header value: bar
Header name: foo header value: baragain
Header name: abc header value: xyz

As you can see the "foo" header was received with 2 different values. So I believe this isn't a Tomcat issue. I'm on Tomcat 5.5.x by the way. You'll have to check with the cocoa-rest-client to make sure the headers are indeed being passed with different values.

Thank you very much Sir, i did test it using curl command and the duplicate headers were really detected and my application threw the error I expected. It seems this is a bug on RESTClient.

[Jaikiran Pai]

aries dimagiba wrote: i did test it using curl command and the duplicate headers were really detected and my application threw the error I expected

Good to know