jetty/jetty.project

Question: AbstractProxyServlet onServerResponseHeaders addHeader rather than setHeader

Open

#577 opened on May 18, 2016

View on GitHub
 (9 comments) (0 reactions) (1 assignee)Java (3,701 stars) (1,913 forks)batch import
Help Wanted

Description

We have a listener implmenets org.eclipse.jetty.client.api.Response.Listener class and for onHeaders method we have the following implementation

    @Override
    public void onHeaders(Response response) {
        wrappedVersion.onHeaders(response);
    }

this wrappedVersion.onHeaders calls ProxyResponseListener then calls AbstractProxyServlet's onServerResponseHeaders method which calls addHeader.

This is a problem for us because we have configured org.eclipse.jetty.servlets.CrossOriginFilter which has handleSimpleResponse which calls response.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN_HEADER, origin);

And this CORS filter is called before our filter. Which means for our filter onHeaders, rather than replacing the headers, it actually added more headers.

I wonder why Jetty doesn't do setHeader in onServerResponseHeaders? I am guessing this is because we do not want to lose any set cookie headers? And what would be a better design if its something we can improve on our side?

thanks

Contributor guide

Tech stack
java
Domain
backendapi
Issue type
research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
JavaServlet internalsJetty proxy
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
15
Research direction
Investigate the AbstractProxyServlet.onServerResponseHeaders method to understand why addHeader is used instead of setHeader. Review the comments in the issue for maintainer rationale. Consider the interaction with CrossOriginFilter and other filters that set headers. Evaluate if changing to setHeader could break cookie handling or other expected behavior. Propose a design improvement if appropriate.