Re: MACing HTTP requests/responses (Re: Content-Integrity header)

On 2012-07-12 19:00, James M Snell wrote:
> To provide one example... using the servlet API within Apache Tomcat
> 7... I can easily access trailers included in a post.. but there is no
> obvious means of including a trailer in the response...
>
> Given the input...
>
>    POST /Testing/test HTTP/1.1
>    Host: localhost
>    Transfer-Encoding: chunked
>    Content-Type: text/plain
>    Trailer: x-foo
>    TE: chunked
>
>    4
>    ABCD
>    6
>    EFGHIJ
>    0
>    x-foo: test
>
> On the server side...
>
>    protected void doPost(
>      HttpServletRequest request,
>      HttpServletResponse response)
>        throws IOException {
>
>      // outputs null since the trailer hasn't been parsed yet...
>      System.out.println(request.getHeader("x-foo"));
>
>      // consume the input
>      InputStream in = request.getInputStream();
>      int r = -1;
>      while((r = in.read(new byte[100])) > -1) {}
>
>      // outputs the value of the x-foo trailer... so far so good...
>      System.out.println(request.getHeader("x-foo"));
>
>      // let's do a chunked response and try that...
>      response.addHeader("Trailer", "x-foo");
>      OutputStream out = response.getOutputStream();
>      for (int n = 0; n < 10000; n++) {
>        out.write('a');
>      }
>      // x-foo is never included in the response...
>      // there is no obvious means of including trailers
>      // in chunked responses using the servlet api...
>      response.addHeader("x-foo", "response");
>    }
> ...


I have to say that I'm surprised that at least it works for trailers in 
a HttpServletRequest...

Best regards, Julian

Received on Thursday, 12 July 2012 17:10:24 UTC