Implementing Servlet Filters to Dynamically Add HTTP Headers

Problem Background and Requirement Analysis

In Java Servlet development, HTTP request headers are commonly used to pass metadata or authentication information. However, existing interfaces may only provide header key-value maps without direct access to HttpServletRequest objects. For example, when integrating with legacy systems, there is a need to convert request parameters into header values, but the HttpServletRequest interface lacks an addHeader() method. This scenario often arises in filter chains that require dynamic header injection.

Core Solution: Using HttpServletRequestWrapper

Extending the HttpServletRequestWrapper class is a standard approach that allows wrapping the original request and overriding header-related methods. The main idea is to rewrite the getHeader() and getHeaderNames() methods to simulate parameter values as headers. Below is a reorganized code example based on the best answer for clarity.

import java.util.Collections;
import java.util.Enumeration;
import java.util.List;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class ParameterToHeaderWrapper extends HttpServletRequestWrapper {
    public ParameterToHeaderWrapper(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String getHeader(String name) {
        String header = super.getHeader(name);
        if (header != null) {
            return header;
        }
        // If header is absent, try to retrieve from parameters
        return super.getParameter(name);
    }

    @Override
    public Enumeration<String> getHeaderNames() {
        List<String> headerNames = Collections.list(super.getHeaderNames());
        // Add all parameter names to the header name list
        Enumeration<String> paramNames = super.getParameterNames();
        while (paramNames.hasMoreElements()) {
            headerNames.add(paramNames.nextElement());
        }
        return Collections.enumeration(headerNames);
    }
}

In a Servlet filter, pass the wrapped request to the next filter or Servlet:

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

public class CustomFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) 
            throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletRequest wrappedRequest = new ParameterToHeaderWrapper(httpRequest);
        chain.doFilter(wrappedRequest, response);
    }

    @Override
    public void init(FilterConfig filterConfig) {}

    @Override
    public void destroy() {}
}

Supplementary Implementations and Extended Discussion

Other answers provide variant implementations, such as using an internal map to store additional headers and overriding the getHeaders() method to support multi-valued headers. For instance, a more complete wrapper might look like this, optimized from supplementary answers:

import java.util.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class EnhancedHeaderWrapper extends HttpServletRequestWrapper {
    private Map<String, String> additionalHeaders = new HashMap<>();

    public EnhancedHeaderWrapper(HttpServletRequest request) {
        super(request);
    }

    public void addHeader(String name, String value) {
        additionalHeaders.put(name, value);
    }

    @Override
    public String getHeader(String name) {
        if (additionalHeaders.containsKey(name)) {
            return additionalHeaders.get(name);
        }
        return super.getHeader(name);
    }

    @Override
    public Enumeration<String> getHeaderNames() {
        List<String> names = new ArrayList<>(Collections.list(super.getHeaderNames()));
        names.addAll(additionalHeaders.keySet());
        return Collections.enumeration(names);
    }

    @Override
    public Enumeration<String> getHeaders(String name) {
        List<String> values = new ArrayList<>(Collections.list(super.getHeaders(name)));
        if (additionalHeaders.containsKey(name)) {
            values.add(additionalHeaders.get(name));
        }
        return Collections.enumeration(values);
    }
}

This approach is suitable for scenarios requiring dynamic addition of independent headers, such as remote addresses, but potential security risks should be noted, e.g., client-side manipulation of header values via parameters.

Analysis and Best Practices

The advantage of using HttpServletRequestWrapper lies in its flexibility and non-invasiveness, enabling extended functionality without modifying the original request. However, this method may lead to header redundancy or security vulnerabilities, such as parameter overriding native headers. It is recommended to use it only in controlled environments and consider alternatives, like directly passing parameters or refactoring interfaces. Additionally, strict validation should be implemented to allow only specific parameters for conversion.

Conclusion

By extending HttpServletRequestWrapper, developers can effectively simulate HTTP header addition in Servlet filters. This article presents core implementation methods, combined with supplementary examples, emphasizing code rewriting and security considerations. In practical applications, suitable solutions should be selected based on specific needs, prioritizing the principle of least privilege.