Does HttpUrlConnection censor some headers, notabl

Question

I'm trying to create some tests for a web services that implements CORS. So, I need to send Origin headers. When I call addRequestProperty("origin", origin), the origin header does not seem to appear at the server. I say 'seem' -- I'm got a servlet iterating over all the headers printing them out, and it does not appear. I haven't gone all the way to TCPMon or sending the request over a plain socket connection.

The javadoc for HttpUrlConnection doesn't mention any limits that I've seen, but I might have skipped a critical sentence. Is this a well-known limitation?

Answer 1

I found http://javasourcecode.org/html/open-source/jdk/jdk-6u23/sun/net/www/protocol/http/HttpURLConnection.java.html.

The author, cleverly, decided to forbid Origin and other CORS-related headers without actually implementing the CORS spec. It's pretty depressing.