javax.servlet.http

Interface HttpServletRequest

All Superinterfaces:

ServletRequest

All Known Implementing Classes:

HttpServletRequestWrapper

public interface HttpServletRequest
extends ServletRequest

Extends the ServletRequest interface to provide request information for HTTP servlets.

The servlet container creates an HttpServletRequest object and passes it as an argument to the servlet's service methods (doGet, doPost, etc).

Author:

Various

Field Summary

Fields

Modifier and Type	Field and Description
static String	BASIC_AUTH String identifier for Basic authentication.
static String	CLIENT_CERT_AUTH String identifier for Client Certificate authentication.
static String	DIGEST_AUTH String identifier for Digest authentication.
static String	FORM_AUTH String identifier for Form authentication.

Method Summary

Modifier and Type	Method and Description
boolean	authenticate(HttpServletResponse response) Use the container login mechanism configured for the ServletContext to authenticate the user making this request.
String	changeSessionId() Change the session id of the current session associated with this request and return the new session id.
String	getAuthType() Returns the name of the authentication scheme used to protect the servlet.
String	getContextPath() Returns the portion of the request URI that indicates the context of the request.
Cookie[]	getCookies() Returns an array containing all of the Cookie objects the client sent with this request.
long	getDateHeader(String name) Returns the value of the specified request header as a long value that represents a Date object.
String	getHeader(String name) Returns the value of the specified request header as a String.
Enumeration<String>	getHeaderNames() Returns an enumeration of all the header names this request contains.
Enumeration<String>	getHeaders(String name) Returns all the values of the specified request header as an Enumeration of String objects.
default HttpServletMapping	getHttpServletMapping() Return the HttpServletMapping by which the HttpServlet for this HttpServletRequest was invoked.
int	getIntHeader(String name) Returns the value of the specified request header as an int.
String	getMethod() Returns the name of the HTTP method with which this request was made, for example, GET, POST, or PUT.
Part	getPart(String name) Gets the Part with the given name.
Collection<Part>	getParts() Gets all the Part components of this request, provided that it is of type multipart/form-data.
String	getPathInfo() Returns any extra path information associated with the URL the client sent when it made this request.
String	getPathTranslated() Returns any extra path information after the servlet name but before the query string, and translates it to a real path.
String	getQueryString() Returns the query string that is contained in the request URL after the path.
String	getRemoteUser() Returns the login of the user making this request, if the user has been authenticated, or null if the user has not been authenticated.
String	getRequestedSessionId() Returns the session ID specified by the client.
String	getRequestURI() Returns the part of this request's URL from the protocol name up to the query string in the first line of the HTTP request.
StringBuffer	getRequestURL() Reconstructs the URL the client used to make the request.
String	getServletPath() Returns the part of this request's URL that calls the servlet.
HttpSession	getSession() Returns the current session associated with this request, or if the request does not have a session, creates one.
HttpSession	getSession(boolean create) Returns the current HttpSession associated with this request or, if there is no current session and create is true, returns a new session.
default Map<String,String>	getTrailerFields() Get the request trailer fields.
Principal	getUserPrincipal() Returns a java.security.Principal object containing the name of the current authenticated user.
boolean	isRequestedSessionIdFromCookie() Checks whether the requested session ID was conveyed to the server as an HTTP cookie.
boolean	isRequestedSessionIdFromUrl() Deprecated. As of Version 2.1 of the Java Servlet API, use isRequestedSessionIdFromURL() instead.
boolean	isRequestedSessionIdFromURL() Checks whether the requested session ID was conveyed to the server as part of the request URL.
boolean	isRequestedSessionIdValid() Checks whether the requested session ID is still valid.
default boolean	isTrailerFieldsReady() Return a boolean indicating whether trailer fields are ready to read using getTrailerFields().
boolean	isUserInRole(String role) Returns a boolean indicating whether the authenticated user is included in the specified logical "role".
void	login(String username, String password) Validate the provided username and password in the password validation realm used by the web container login mechanism configured for the ServletContext.
void	logout() Establish null as the value returned when getUserPrincipal, getRemoteUser, and getAuthType is called on the request.
default PushBuilder	newPushBuilder() Instantiates a new instance of PushBuilder for issuing server push responses from the current request.
<T extends HttpUpgradeHandler> T	upgrade(Class<T> handlerClass) Creates an instance of HttpUpgradeHandler for a given class and uses it for the http protocol upgrade processing.

Methods inherited from interface javax.servlet.ServletRequest

getAsyncContext, getAttribute, getAttributeNames, getCharacterEncoding, getContentLength, getContentLengthLong, getContentType, getDispatcherType, getInputStream, getLocalAddr, getLocale, getLocales, getLocalName, getLocalPort, getParameter, getParameterMap, getParameterNames, getParameterValues, getProtocol, getReader, getRealPath, getRemoteAddr, getRemoteHost, getRemotePort, getRequestDispatcher, getScheme, getServerName, getServerPort, getServletContext, isAsyncStarted, isAsyncSupported, isSecure, removeAttribute, setAttribute, setCharacterEncoding, startAsync, startAsync

Field Detail

BASIC_AUTH

static final String BASIC_AUTH

String identifier for Basic authentication. Value "BASIC"

See Also:

Constant Field Values

FORM_AUTH

static final String FORM_AUTH

String identifier for Form authentication. Value "FORM"

See Also:

Constant Field Values

CLIENT_CERT_AUTH

static final String CLIENT_CERT_AUTH

String identifier for Client Certificate authentication. Value "CLIENT_CERT"

See Also:

Constant Field Values

DIGEST_AUTH

static final String DIGEST_AUTH

String identifier for Digest authentication. Value "DIGEST"

See Also:

Constant Field Values

Method Detail

getAuthType

String getAuthType()

Returns the name of the authentication scheme used to protect the servlet. All servlet containers support basic, form and client certificate authentication, and may additionally support digest authentication. If the servlet is not authenticated null is returned.

Same as the value of the CGI variable AUTH_TYPE.

Returns:

one of the static members BASIC_AUTH, FORM_AUTH, CLIENT_CERT_AUTH, DIGEST_AUTH (suitable for == comparison) or the container-specific string indicating the authentication scheme, or null if the request was not authenticated.

getCookies

Cookie[] getCookies()

Returns an array containing all of the Cookie objects the client sent with this request. This method returns null if no cookies were sent.

Returns:

an array of all the Cookies included with this request, or null if the request has no cookies

getDateHeader

long getDateHeader(String name)

Returns the value of the specified request header as a long value that represents a Date object. Use this method with headers that contain dates, such as If-Modified-Since.

The date is returned as the number of milliseconds since January 1, 1970 GMT. The header name is case insensitive.

If the request did not have a header of the specified name, this method returns -1. If the header can't be converted to a date, the method throws an IllegalArgumentException.

Parameters:

name - a String specifying the name of the header

Returns:

a long value representing the date specified in the header expressed as the number of milliseconds since January 1, 1970 GMT, or -1 if the named header was not included with the request

Throws:

IllegalArgumentException - If the header value can't be converted to a date

getHeader

String getHeader(String name)

Returns the value of the specified request header as a String. If the request did not include a header of the specified name, this method returns null. If there are multiple headers with the same name, this method returns the first head in the request. The header name is case insensitive. You can use this method with any request header.

Parameters:

name - a String specifying the header name

Returns:

a String containing the value of the requested header, or null if the request does not have a header of that name

getHeaders

Enumeration<String> getHeaders(String name)

Returns all the values of the specified request header as an Enumeration of String objects.

Some headers, such as Accept-Language can be sent by clients as several headers each with a different value rather than sending the header as a comma separated list.

If the request did not include any headers of the specified name, this method returns an empty Enumeration. The header name is case insensitive. You can use this method with any request header.

Parameters:

name - a String specifying the header name

Returns:

an Enumeration containing the values of the requested header. If the request does not have any headers of that name return an empty enumeration. If the container does not allow access to header information, return null

getHeaderNames

Enumeration<String> getHeaderNames()

Returns an enumeration of all the header names this request contains. If the request has no headers, this method returns an empty enumeration.

Some servlet containers do not allow servlets to access headers using this method, in which case this method returns null

Returns:

an enumeration of all the header names sent with this request; if the request has no headers, an empty enumeration; if the servlet container does not allow servlets to use this method, null

getIntHeader

int getIntHeader(String name)

Returns the value of the specified request header as an int. If the request does not have a header of the specified name, this method returns -1. If the header cannot be converted to an integer, this method throws a NumberFormatException.

The header name is case insensitive.

Parameters:

name - a String specifying the name of a request header

Returns:

an integer expressing the value of the request header or -1 if the request doesn't have a header of this name

Throws:

NumberFormatException - If the header value can't be converted to an int

getHttpServletMapping

default HttpServletMapping getHttpServletMapping()

Return the HttpServletMapping by which the HttpServlet for this HttpServletRequest was invoked. The mappings for any applicable Filters are not indicated in the result. If the currently active Servlet invocation was obtained by a call to ServletRequest.getRequestDispatcher(java.lang.String) followed by a call to RequestDispatcher.forward(javax.servlet.ServletRequest, javax.servlet.ServletResponse), the returned HttpServletMapping is the one corresponding to the path used to obtain the RequestDispatcher. If the currently active Servlet invocation was obtained by a call to ServletRequest.getRequestDispatcher(java.lang.String) followed by a call to RequestDispatcher.include(javax.servlet.ServletRequest, javax.servlet.ServletResponse), the returned HttpServletMapping is the one corresponding to the path that caused the first Servlet in the invocation sequence to be invoked. If the currently active Servlet invocation was obtained by a call to AsyncContext.dispatch(), the returned HttpServletMapping is the one corresponding to the path that caused the first Servlet in the invocation sequence to be invoked. See RequestDispatcher.FORWARD_MAPPING, RequestDispatcher.INCLUDE_MAPPING and AsyncContext.ASYNC_MAPPING for additional request attributes related to HttpServletMapping. If the currently active Servlet invocation was obtained by a call to ServletContext.getNamedDispatcher(java.lang.String), the returned HttpServletMapping is the one corresponding to the path for the mapping last applied to this request.

The returned object is immutable. Servlet 4.0 compliant implementations must override this method.

Returns:

An instance of HttpServletMapping describing the manner in which the current request was invoked.

Since:

4.0

Implementation Specification:

The default implementation returns a HttpServletMapping that returns the empty string for the match value, pattern and servlet name and null for the match type.

getMethod

String getMethod()

Returns the name of the HTTP method with which this request was made, for example, GET, POST, or PUT. Same as the value of the CGI variable REQUEST_METHOD.

Returns:

a String specifying the name of the method with which this request was made

getPathInfo

String getPathInfo()

Returns any extra path information associated with the URL the client sent when it made this request. The extra path information follows the servlet path but precedes the query string and will start with a "/" character.

This method returns null if there was no extra path information.

Same as the value of the CGI variable PATH_INFO.

Returns:

a String, decoded by the web container, specifying extra path information that comes after the servlet path but before the query string in the request URL; or null if the URL does not have any extra path information

getPathTranslated

String getPathTranslated()

Returns any extra path information after the servlet name but before the query string, and translates it to a real path. Same as the value of the CGI variable PATH_TRANSLATED.

If the URL does not have any extra path information, this method returns null or the servlet container cannot translate the virtual path to a real path for any reason (such as when the web application is executed from an archive). The web container does not decode this string.

Returns:

a String specifying the real path, or null if the URL does not have any extra path information

newPushBuilder

default PushBuilder newPushBuilder()

Instantiates a new instance of PushBuilder for issuing server push responses from the current request. This method returns null if the current connection does not support server push, or server push has been disabled by the client via a SETTINGS_ENABLE_PUSH settings frame value of 0 (zero).

Returns:

a PushBuilder for issuing server push responses from the current request, or null if push is not supported

Since:

Servlet 4.0

Implementation Specification:

The default implementation returns null.

getContextPath

String getContextPath()

Returns the portion of the request URI that indicates the context of the request. The context path always comes first in a request URI. The path starts with a "/" character but does not end with a "/" character. For servlets in the default (root) context, this method returns "". The container does not decode this string.

It is possible that a servlet container may match a context by more than one context path. In such cases this method will return the actual context path used by the request and it may differ from the path returned by the ServletContext.getContextPath() method. The context path returned by ServletContext.getContextPath() should be considered as the prime or preferred context path of the application.

Returns:

a String specifying the portion of the request URI that indicates the context of the request

See Also:

ServletContext.getContextPath()

getQueryString

String getQueryString()

Returns the query string that is contained in the request URL after the path. This method returns null if the URL does not have a query string. Same as the value of the CGI variable QUERY_STRING.

Returns:

a String containing the query string or null if the URL contains no query string. The value is not decoded by the container.

getRemoteUser

String getRemoteUser()

Returns the login of the user making this request, if the user has been authenticated, or null if the user has not been authenticated. Whether the user name is sent with each subsequent request depends on the browser and type of authentication. Same as the value of the CGI variable REMOTE_USER.

Returns:

a String specifying the login of the user making this request, or null if the user login is not known

isUserInRole

boolean isUserInRole(String role)

Returns a boolean indicating whether the authenticated user is included in the specified logical "role". Roles and role membership can be defined using deployment descriptors. If the user has not been authenticated, the method returns false.

The role name "*" should never be used as an argument in calling isUserInRole. Any call to isUserInRole with "*" must return false. If the role-name of the security-role to be tested is "**", and the application has NOT declared an application security-role with role-name "**", isUserInRole must only return true if the user has been authenticated; that is, only when getRemoteUser() and getUserPrincipal() would both return a non-null value. Otherwise, the container must check the user for membership in the application role.

Parameters:

role - a String specifying the name of the role

Returns:

a boolean indicating whether the user making this request belongs to a given role; false if the user has not been authenticated

getUserPrincipal

Principal getUserPrincipal()

Returns a java.security.Principal object containing the name of the current authenticated user. If the user has not been authenticated, the method returns null.

Returns:

a java.security.Principal containing the name of the user making this request; null if the user has not been authenticated

getRequestedSessionId

String getRequestedSessionId()

Returns the session ID specified by the client. This may not be the same as the ID of the current valid session for this request. If the client did not specify a session ID, this method returns null.

Returns:

a String specifying the session ID, or null if the request did not specify a session ID

See Also:

isRequestedSessionIdValid()

getRequestURI

String getRequestURI()

Returns the part of this request's URL from the protocol name up to the query string in the first line of the HTTP request. The web container does not decode this String. For example:

First line of HTTP request	Returned Value
POST /some/path.html HTTP/1.1		/some/path.html
GET http://foo.bar/a.html HTTP/1.0		/a.html
HEAD /xyz?a=b HTTP/1.1		/xyz

To reconstruct an URL with a scheme and host, use HttpUtils.getRequestURL(javax.servlet.http.HttpServletRequest).

Returns:

a String containing the part of the URL from the protocol name up to the query string

See Also:

HttpUtils.getRequestURL(javax.servlet.http.HttpServletRequest)

getRequestURL

StringBuffer getRequestURL()

Reconstructs the URL the client used to make the request. The returned URL contains a protocol, server name, port number, and server path, but it does not include query string parameters.

If this request has been forwarded using RequestDispatcher.forward(javax.servlet.ServletRequest, javax.servlet.ServletResponse), the server path in the reconstructed URL must reflect the path used to obtain the RequestDispatcher, and not the server path specified by the client.

Because this method returns a StringBuffer, not a string, you can modify the URL easily, for example, to append query parameters.

This method is useful for creating redirect messages and for reporting errors.

Returns:

a StringBuffer object containing the reconstructed URL

getServletPath

String getServletPath()

Returns the part of this request's URL that calls the servlet. This path starts with a "/" character and includes either the servlet name or a path to the servlet, but does not include any extra path information or a query string. Same as the value of the CGI variable SCRIPT_NAME.

This method will return an empty string ("") if the servlet used to process this request was matched using the "/*" pattern.

Returns:

a String containing the name or path of the servlet being called, as specified in the request URL, decoded, or an empty string if the servlet used to process the request is matched using the "/*" pattern.

getSession

HttpSession getSession(boolean create)

Returns the current HttpSession associated with this request or, if there is no current session and create is true, returns a new session.

If create is false and the request has no valid HttpSession, this method returns null.

To make sure the session is properly maintained, you must call this method before the response is committed. If the container is using cookies to maintain session integrity and is asked to create a new session when the response is committed, an IllegalStateException is thrown.

Parameters:

create - true to create a new session for this request if necessary; false to return null if there's no current session

Returns:

the HttpSession associated with this request or null if create is false and the request has no valid session

See Also:

getSession()

getSession

HttpSession getSession()

Returns the current session associated with this request, or if the request does not have a session, creates one.

Returns:

the HttpSession associated with this request

See Also:

getSession(boolean)

changeSessionId

String changeSessionId()

Change the session id of the current session associated with this request and return the new session id.

Returns:

the new session id

Throws:

IllegalStateException - if there is no session associated with the request

Since:

Servlet 3.1

isRequestedSessionIdValid

boolean isRequestedSessionIdValid()

Checks whether the requested session ID is still valid.

If the client did not specify any session ID, this method returns false.

Returns:

true if this request has an id for a valid session in the current session context; false otherwise

See Also:

getRequestedSessionId(), getSession(boolean), HttpSessionContext

isRequestedSessionIdFromCookie

boolean isRequestedSessionIdFromCookie()

Checks whether the requested session ID was conveyed to the server as an HTTP cookie.

Returns:

true if the session ID was conveyed to the server an an HTTP cookie; otherwise, false

See Also:

getSession(boolean)

isRequestedSessionIdFromURL

boolean isRequestedSessionIdFromURL()

Checks whether the requested session ID was conveyed to the server as part of the request URL.

Returns:

true if the session ID was conveyed to the server as part of a URL; otherwise, false

See Also:

getSession(boolean)

isRequestedSessionIdFromUrl

@Deprecated
boolean isRequestedSessionIdFromUrl()

Deprecated. As of Version 2.1 of the Java Servlet API, use isRequestedSessionIdFromURL() instead.

Returns:

true if the session ID was conveyed to the server as part of a URL; otherwise, false

authenticate

boolean authenticate(HttpServletResponse response)
              throws IOException,
                     ServletException

Use the container login mechanism configured for the ServletContext to authenticate the user making this request.

This method may modify and commit the argument HttpServletResponse.

Parameters:

response - The HttpServletResponse associated with this HttpServletRequest

Returns:

true when non-null values were or have been established as the values returned by getUserPrincipal, getRemoteUser, and getAuthType. Return false if authentication is incomplete and the underlying login mechanism has committed, in the response, the message (e.g., challenge) and HTTP status code to be returned to the user.

Throws:

IOException - if an input or output error occurred while reading from this request or writing to the given response

IllegalStateException - if the login mechanism attempted to modify the response and it was already committed

ServletException - if the authentication failed and the caller is responsible for handling the error (i.e., the underlying login mechanism did NOT establish the message and HTTP status code to be returned to the user)

Since:

Servlet 3.0

login

void login(String username,
           String password)
    throws ServletException

Validate the provided username and password in the password validation realm used by the web container login mechanism configured for the ServletContext.

This method returns without throwing a ServletException when the login mechanism configured for the ServletContext supports username password validation, and when, at the time of the call to login, the identity of the caller of the request had not been established (i.e, all of getUserPrincipal, getRemoteUser, and getAuthType return null), and when validation of the provided credentials is successful. Otherwise, this method throws a ServletException as described below.

When this method returns without throwing an exception, it must have established non-null values as the values returned by getUserPrincipal, getRemoteUser, and getAuthType.

Parameters:

username - The String value corresponding to the login identifier of the user.

password - The password String corresponding to the identified user.

Throws:

ServletException - if the configured login mechanism does not support username password authentication, or if a non-null caller identity had already been established (prior to the call to login), or if validation of the provided username and password fails.

Since:

Servlet 3.0

logout

void logout()
     throws ServletException

Establish null as the value returned when getUserPrincipal, getRemoteUser, and getAuthType is called on the request.

Throws:

ServletException - if logout fails

Since:

Servlet 3.0

getParts

Collection<Part> getParts()
                   throws IOException,
                          ServletException

Gets all the Part components of this request, provided that it is of type multipart/form-data.

If this request is of type multipart/form-data, but does not contain any Part components, the returned Collection will be empty.

Any changes to the returned Collection must not affect this HttpServletRequest.

Returns:

a (possibly empty) Collection of the Part components of this request

Throws:

IOException - if an I/O error occurred during the retrieval of the Part components of this request

ServletException - if this request is not of type multipart/form-data

IllegalStateException - if the request body is larger than maxRequestSize, or any Part in the request is larger than maxFileSize, or there is no @MultipartConfig or multipart-config in deployment descriptors

Since:

Servlet 3.0

See Also:

MultipartConfig.maxFileSize(), MultipartConfig.maxRequestSize()

getPart

Part getPart(String name)
      throws IOException,
             ServletException

Gets the Part with the given name.

Parameters:

name - the name of the requested Part

Returns:

The Part with the given name, or null if this request is of type multipart/form-data, but does not contain the requested Part

Throws:

IOException - if an I/O error occurred during the retrieval of the requested Part

ServletException - if this request is not of type multipart/form-data

IllegalStateException - if the request body is larger than maxRequestSize, or any Part in the request is larger than maxFileSize, or there is no @MultipartConfig or multipart-config in deployment descriptors

Since:

Servlet 3.0

See Also:

MultipartConfig.maxFileSize(), MultipartConfig.maxRequestSize()

upgrade

<T extends HttpUpgradeHandler> T upgrade(Class<T> handlerClass)
                                  throws IOException,
                                         ServletException

Creates an instance of HttpUpgradeHandler for a given class and uses it for the http protocol upgrade processing.

Type Parameters:

T - The Class, which extends HttpUpgradeHandler, of the handlerClass.

Parameters:

handlerClass - The HttpUpgradeHandler class used for the upgrade.

Returns:

an instance of the HttpUpgradeHandler

Throws:

IOException - if an I/O error occurred during the upgrade

ServletException - if the given handlerClass fails to be instantiated

Since:

Servlet 3.1

See Also:

HttpUpgradeHandler, WebConnection

getTrailerFields

default Map<String,String> getTrailerFields()

Get the request trailer fields.

The returned map is not backed by the HttpServletRequest object, so changes in the returned map are not reflected in the HttpServletRequest object, and vice-versa.

isTrailerFieldsReady() should be called first to determine if it is safe to call this method without causing an exception.

Returns:

A map of trailer fields in which all the keys are in lowercase, regardless of the case they had at the protocol level. If there are no trailer fields, yet isTrailerFieldsReady() is returning true, the empty map is returned.

Throws:

IllegalStateException - if isTrailerFieldsReady() is false

Since:

Servlet 4.0

Implementation Specification:

The default implementation returns an empty map.

isTrailerFieldsReady

default boolean isTrailerFieldsReady()

Return a boolean indicating whether trailer fields are ready to read using getTrailerFields(). This methods returns true immediately if it is known that there is no trailer in the request, for instance, the underlying protocol (such as HTTP 1.0) does not supports the trailer fields, or the request is not in chunked encoding in HTTP 1.1. And the method also returns true if both of the following conditions are satisfied:

1. the application has read all the request data and an EOF indication has been returned from the ServletRequest.getReader() or ServletRequest.getInputStream().
2. all the trailer fields sent by the client have been received. Note that it is possible that the client has sent no trailer fields.

Returns:

a boolean whether trailer fields are ready to read

Since:

Servlet 4.0

Implementation Specification:

The default implementation returns false.