Calling request.setAttribute after chain.doFilter

Question

OK. so basically what I would like to do is the set a list of object to the HttpServletRequest as a parameter like this:

request.setAttribute("Param", objs);

And then I want to modify the list of these object in a filter so I can delete a few which the user is not authorized to see.

like this:

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

    chain.doFilter(request, response);
    request.removeAttribute("Param");


}

But it doesn't do anything. Can anybody help me?

It is not clear what you are trying to achieve. Request attributes are not returned to the browser. If you want to clear some attributes between your servlet and jsp, you could try to mark that filter `FORWARD` and do that removeAttribute call before chain.doFilter(). But it may brake your UI. And if you don't want to show it, why are you setting it in the first place? — Gas, Oct 16 '14 at 00:19

score 0 · Accepted Answer · answered Oct 15 '14 at 21:38

0

It is not surprising that modifying the request attributes after the chain.doFilter in a filter be a no op. The servlet and/or jsp have already finished their part. You normally only do cleanup in that place.

answered Oct 15 '14 at 21:38

Serge Ballesta

143,923
11
122
252

So there is no other way but doing the job in a servlet? – DalekSupreme Oct 15 '14 at 23:10
@DarlekSupreme Filter is not the right place for that, so it will end in a servlet, or in an utility class called from a servlet. The good question is : what is your real problem ? – Serge Ballesta Oct 16 '14 at 05:34
my real problem was that I thought that I can filter the response with the server in a way to manipulate what is going back to the client but clearly I was wrong... – DalekSupreme Oct 16 '14 at 08:27
You can, but you asked about a request attribute. Request attributes don't go back to the clean. Nothig about the request goes back to the client. The *response* goes back to the client. But not attributes, only parameters in headers. – user207421 Oct 16 '14 at 20:31

score 0 · Answer 2 · answered Oct 15 '14 at 22:12

(AFAIK) The end user will not be able to see any of your objects in the Request Object unless there is some view that exposes that particular attribute. Meaning that you would have to show that particular request attribute in a jsp (as html), or as a json string, etc...

user207421 · Answer 3 · 2014-10-16T02:31:03.753

Your question is rather confused. The only place you can sensibly set a request attribute is either in a filter before calling doFilter():

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    request.setAttribute("Param", objs);
    chain.doFilter(request, response);
    request.removeAttribute("Param");
}

or else in the servlet itself, which executes as the end result of all the doFilter()calls, and therefore happens after filter invocation, not before.

As noted by others, cleaning it up afterwards isn't necessary.

score 0 · Answer 4 · answered Mar 14 '18 at 11:55

In my case I've solved it using an approximation similar to this solution.

Using request wrapper you can override setAttribute method to store the values inserted by your servlet/beans, etc. in a map and keep them after the container flushes the request. This way you can obtain the values from your map after the doChain() method.

Calling request.setAttribute after chain.doFilter

4 Answers4