jersey
jersey copied to clipboard
HttpUrlConnector and JettyConnector doesn't log the headers modified by MultiPartWriter
When using the LoggingFeature, the actual request sent should be logged by the LoggingInterceptor, even if the MultiPartFeature is used. If the headers don't already include a header MIME-Version and a header Content-Type with a boundary, they are added by the MultiPartWriter:
https://github.com/eclipse-ee4j/jersey/blob/b0c503d04e1712837e7985fccca76cbc1b78e932/media/multipart/src/main/java/org/glassfish/jersey/media/multipart/internal/MultiPartWriter.java#L122-L136
Unfortunately, the modified headers aren't logged:
Feb. 09, 2024 4:31:44 PM org.glassfish.jersey.logging.LoggingInterceptor log
INFORMATION: 1 * Sending client request on thread Test worker
1 > POST https://example.com/api/document
1 > Accept: application/json
1 > Content-Type: multipart/form-data
1 > User-Agent: jersey-client/3.1.5 (java)
--Boundary_1_905404580_1707400346199
Content-Type: application/octet-stream
Content-Disposition: form-data; filename="file-1065460366320764802.tmp"; size=7110; name="contents"
%PDF-1.3
%���������
...
--Boundary_1_905404580_1707400346199
Content-Type: application/json
Content-Disposition: form-data; name="metadaten"
{"name":"Passport.pdf","type":"Passport"}
--Boundary_1_905404580_1707400346199--
This can lead to time-consuming debugging sessions, as it requires third-party tools to be used as a workaround to verify the actual requests.
It seems LoggingInterceptor is called to early.
Notwithstanding the above, HttpUrlConnector doesn't call HeaderUtils.checkHeaderChanges(...) as other connectors. I haven't checked all others, but at least ApacheConnector, Apache5Connector and JettyConnector are calling the header checker.
I am not sure the LoggingInterceptor can be modified - it is the chicken-egg issue.
The WriterInterceptor must be invoked before the MessageBodyWriter because it can modify the HttpHeaders. So can the MessageBodyWriter modify the headers and it expects the headers already to be altered by all the Interceptors. So the WritingInterceptor cannot be invoked after the MessageBodyWriter.
As for the header check, the warning is there for the 3rd part connectors so that the modifications to headers, that are not sent to the server are noticed by the users. The ability to send the headers altered by the MBWs is there just recently, For the default HttpUrlConnector, the altered headers were always possible to send and the check was not required.