1

AJP_ attributes sent from apache mod_proxy_ajp to tomcat ajp connector can be retrieved with java code like

String attributeValue = request.getAttribute(attributeName);

Doing so, I have seen that these forwarded attributeNames are not listed in the enumeration we get with request.getAttributeNames(). This last method return only these 4 ones, missing the AJP_* attributes:

javax.servlet.forward.request_uri
javax.servlet.forward.context_path
javax.servlet.forward.servlet_path
javax.servlet.forward.path_info
javax.servlet.forward.mapping

For example I can retrieve a "groupID" in my java with request.getAttribute("groupID") but request.getAttributeNames() doesn't list "groupID". Why ??

ENV: Apache Tomcat/8.5.54 (Debian) Apache/2.4.25 (Debian)

Bernard

user3134250
  • 71
  • 8

1 Answers1

0

This is by design. These attributes are "hidden" and will not appear in the return value from ServletRequest.getAttrbuteNames. You have to know the names of the attributes in order to fetch them.

Christopher Schultz
  • 20,221
  • 9
  • 60
  • 77
  • This does seem to be the case, I'm not sure about the 'by design' bit though. My top tip to find these attributes is to set allowedRequestAttributesPattern to something that won't match the attribute names, the request will fail stating the names of the incoming attributes that it is taking umbrage at – Jim ReesPotter Mar 04 '23 at 13:48