[FIXED] Modify request header going into a controller and response header leaving a Spring Boot RestController

Issue

This feels like it should be a simple thing, but I'm still pretty new to SpringBoot, and the whole Servlet ecosystem, so it's not readily apparent. I would love an interface similar to HandlerInterceptor that allows me to modify the request and response object once I'm done in a controller. Even better would be to decorate mapping annotation, so I can specify which controllers need the operation.

The problem I'm solving right now, though I anticipate expanding this in the future, is that I have an encrypted header coming into my application that I would like to decrypt for use in the controller and then encrypt again on the way out.

EDIT: For clarity.

I have a rest controller, something like:

    @RestController
        public class PojoService {
            @GetMapping(value = "/path/to/resource")
                public ResponseEntity<SomeClass> getLocationData(
@RequestHeader(value = "EncryptedHeader", required = false) String ecryptedHeaderValue) {
                    DecryptionObject decryptedHeader = new DecryptionObject(pageHeaderValue);
                    SomePojo result = getResult();
                    return decryptedHeader.decorateResponseWithEncryptedHeader(result);
                }
    }

I would love to not have the DecryptionObject on every mapping, but rather, before I even get to the mapping, I decrypt the header via some filter or hook and then re-encrypt the header on the way out. Then my code would look something like:

    @RestController
        public class PojoService {
            @GetMapping(value = "/path/to/resource", decryptHeader="EncryptedHeader")
                public ResponseEntity<SomeClass> getLocationData(
@RequestHeader(value = "EncryptedHeader", required = false) String decryptedHeaderValue) {
                    SomePojo result = getResult();
                    return result;
                }
    }

I found that the HandlerInterceptor doesn't work because I cannot modify the request or response in the interceptor. Hope that clarifies the issue.

Solution

You can still use HandlerInterceptor. Create your class implementing HandlerInterceptor, and then register it using another class which extends WebMvcConfigurer.

@EnableWebMvc
@Configuration
@ComponentScan
public class MyWebConfig implements WebMvcConfigurer {
    public void addInterceptors(InterceptorRegistry registry) {
         registry.addInterceptor(new [...]); //Apply to all controllers
         registry.addInterceptor(new [...]).addPathPatterns("path1","path2"); //Apply to specific paths to restrict to some controllers.
    }
}

You also could do it using a Filter - create your Filter class and register it by declaring a @Bean of type FilterRegistrationBean - this also allows you to restrict to some paths.

UPDATE: You could do this with request attributes which can be set by interceptors (request.setAttribute("decryptedHeaderValue",<decrypted>). Or if you're specific about using headers, a filter would be more suitable for your purpose. Create a new wrapped request type that wraps the incoming request and does whatever you want, and pass this wrapper to the next filter in chain.

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
    [...]
    HttpServletRequestWrapper decryptedRequest = new HttpServletRequestWrapper((HttpServletRequest) request) {
       public String getHeader(String name) {
            if (name.equals("DecryptedHeader")) {
                  String encrypted = super.getHeader("EncryptedHeader");
                  String decrypted = decrypt(encrypted);
                  return decrypted;
            }
            return super.getHeader(name); //Default behavior
       }
   }

   
   chain.doFilter(decryptedRequest, response); //Pass on the custom request down
}

Then any class down the line (other filters, controllers etc) can just call request.getHeader("DecryptedHeader") to retrieve the decrypted header. This is just one of many similar approaches. You can restrict the paths for which this filter executes when registering it.

For response, there is a similar class HttpServletResponseWrapper which you can use for customization.

Answered By - Vasan
Answer Checked By - Mary Flores (JavaFixing Volunteer)