Can I override the Host header where using java's HttpUrlConnection class?

Question

I'm using the following code to open a http connection in java:

 URL url = new URL("http://stackoverflow.com");
 HttpURLConnection conn = (HttpURLConnection) url.openConnection();
 conn.setDoOutput(true);
 conn.setRequestMethod("GET");
 conn.setRequestProperty("Host", "Test:8080");
 conn.getOutputStream();

However calling conn.setRequestProperty("Host", "Test:8080") appears to have no effect regardless of what order I call the methods and the Host is reset to the destination server. Is there any way to override the Host header without using a different library?

TIA Matt

score 41 · Answer 1 · edited May 23 '17 at 12:32

41

This used to work in the past, but it has been disabled as part of a security-fix. Apparently without a note in the changelog. There are even bugs like #7022056 for this at bugs.sun.com.

There is a similar question for another header, where the answer goes more into the details, so I just link it instead of writing it myself. :-)

The only workarounds seem to be setting sun.net.http.allowRestrictedHeaders to true or use another http-library like the already mentioned http components.

edited May 23 '17 at 12:32

Community

1
1

answered Nov 17 '11 at 19:01

Boris

4,327
2
19
27

15

Thanks, `System.setProperty("sun.net.http.allowRestrictedHeaders", "true")` works great. – Pete Doyle Dec 28 '11 at 00:54
1

Ah, just spent a few hours debugging this and searching for an answer! Many thanks. – XXL May 05 '12 at 20:30
Yep, System.setProperty("sun.net.http.allowRestrictedHeaders", "true") works great – Nathan B Jun 30 '22 at 04:06

Bozho · Answer 2 · 2011-10-05T12:18:57.760

8

The Host header is filled by the HttpURLConnection based on the URL. You can't open foo.com with Host=bar.com. From the RFC

The Host request-header field specifies the Internet host and port number of the resource being requested, as obtained from the original URI given by the user or referring resource (generally an HTTP URL)

Btw, you can also try apache http components.

edited Oct 05 '11 at 12:18

answered Oct 04 '11 at 13:57

Bozho

588,226
146
1,060
1,140

2

Thanks, it may well be RFC compliant but it's not very helpful as I'm, trying to implement a reverse proxy which requires the port on the host header to be modified as the destination server is expecting port mapping. – Matt Oct 04 '11 at 14:11
you can try apache http components – Bozho Oct 04 '11 at 14:14
1

Generally I agree, but you may have to connect to a weird remote system out of your control which has no DNS-entry but still wants the correct Host-header because it has vhosts. Sadly I had such a case today, but I hope (for the sake of all others) that they are really rare. ;-) – Boris Nov 17 '11 at 19:13

score -2 · Answer 3 · answered Mar 18 '15 at 18:16

This is an issue with how volley handles HTTPUrlConnection and retry policy.

A Quick fix for it is to extend "HurlStack" class and override the "createConnection" function to return a HTTPUrlConnection with ChunkStreamMode of 0

public class CustomHurlStack extends HurlStack {


   public CustomHurlStack(){
       super();

   }

   @Override
   protected HttpURLConnection createConnection(URL url) throws IOException {
       HttpURLConnection connection = super.createConnection(url);
       connection.setChunkedStreamingMode(0);
       return connection;
   }

}

Can I override the Host header where using java's HttpUrlConnection class?

3 Answers3

Linked