javax.servlet.http

## Interface HttpServletRequest

- All Superinterfaces:
    ServletRequest
  All Known Implementing Classes:
    HttpServletRequestWrapper

      public interface HttpServletRequest
      extends ServletRequest

  Extends the `ServletRequest` interface to provide request information for HTTP servlets.

  The servlet container creates an `HttpServletRequest` object and passes it as an argument to the servlet's service methods (`doGet`, `doPost`, etc).

  Author:
    Various

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static String` | `BASIC_AUTH` String identifier for Basic authentication.
    `static String` | `CLIENT_CERT_AUTH` String identifier for Client Certificate authentication.
    `static String` | `DIGEST_AUTH` String identifier for Digest authentication.
    `static String` | `FORM_AUTH` String identifier for Form authentication.

  - ### Method Summary

    Methods
    Modifier and Type | Method and Description
    --- | ---
    `boolean` | `authenticate(HttpServletResponse response)` Use the container login mechanism configured for the `ServletContext` to authenticate the user making this request.
    `String` | `changeSessionId()` Change the session id of the current session associated with this request and return the new session id.
    `String` | `getAuthType()` Returns the name of the authentication scheme used to protect the servlet.
    `String` | `getContextPath()` Returns the portion of the request URI that indicates the context of the request.
    `Cookie[]` | `getCookies()` Returns an array containing all of the `Cookie` objects the client sent with this request.
    `long` | `getDateHeader(String name)` Returns the value of the specified request header as a `long` value that represents a `Date` object.
    `String` | `getHeader(String name)` Returns the value of the specified request header as a `String`.
    `Enumeration<String>` | `getHeaderNames()` Returns an enumeration of all the header names this request contains.
    `Enumeration<String>` | `getHeaders(String name)` Returns all the values of the specified request header as an `Enumeration` of `String` objects.
    `int` | `getIntHeader(String name)` Returns the value of the specified request header as an `int`.
    `String` | `getMethod()` Returns the name of the HTTP method with which this request was made, for example, GET, POST, or PUT.
    `Part` | `getPart(String name)` Gets the `Part` with the given name.
    `Collection<Part>` | `getParts()` Gets all the `Part` components of this request, provided that it is of type `multipart/form-data`.
    `String` | `getPathInfo()` Returns any extra path information associated with the URL the client sent when it made this request.
    `String` | `getPathTranslated()` Returns any extra path information after the servlet name but before the query string, and translates it to a real path.
    `String` | `getQueryString()` Returns the query string that is contained in the request URL after the path.
    `String` | `getRemoteUser()` Returns the login of the user making this request, if the user has been authenticated, or `null` if the user has not been authenticated.
    `String` | `getRequestedSessionId()` Returns the session ID specified by the client.
    `String` | `getRequestURI()` Returns the part of this request's URL from the protocol name up to the query string in the first line of the HTTP request.
    `StringBuffer` | `getRequestURL()` Reconstructs the URL the client used to make the request.
    `String` | `getServletPath()` Returns the part of this request's URL that calls the servlet.
    `HttpSession` | `getSession()` Returns the current session associated with this request, or if the request does not have a session, creates one.
    `HttpSession` | `getSession(boolean create)` Returns the current `HttpSession` associated with this request or, if there is no current session and `create` is true, returns a new session.
    `Principal` | `getUserPrincipal()` Returns a `java.security.Principal` object containing the name of the current authenticated user.
    `boolean` | `isRequestedSessionIdFromCookie()` Checks whether the requested session ID came in as a cookie.
    `boolean` | `isRequestedSessionIdFromUrl()` Deprecated. As of Version 2.1 of the Java Servlet API, use `isRequestedSessionIdFromURL()` instead.
    `boolean` | `isRequestedSessionIdFromURL()` Checks whether the requested session ID came in as part of the request URL.
    `boolean` | `isRequestedSessionIdValid()` Checks whether the requested session ID is still valid.
    `boolean` | `isUserInRole(String role)` Returns a boolean indicating whether the authenticated user is included in the specified logical "role".
    `void` | `login(String username, String password)` Validate the provided username and password in the password validation realm used by the web container login mechanism configured for the `ServletContext`.
    `void` | `logout()` Establish `null` as the value returned when `getUserPrincipal`, `getRemoteUser`, and `getAuthType` is called on the request.
    `<T extends HttpUpgradeHandler> T` | `upgrade(Class<T> handlerClass)` Create an instance of `HttpUpgradeHandler` for an given class and uses it for the http protocol upgrade processing.

    - ### Methods inherited from interface javax.servlet.ServletRequest

      `getAsyncContext, getAttribute, getAttributeNames, getCharacterEncoding, getContentLength, getContentLengthLong, getContentType, getDispatcherType, getInputStream, getLocalAddr, getLocale, getLocales, getLocalName, getLocalPort, getParameter, getParameterMap, getParameterNames, getParameterValues, getProtocol, getReader, getRealPath, getRemoteAddr, getRemoteHost, getRemotePort, getRequestDispatcher, getScheme, getServerName, getServerPort, getServletContext, isAsyncStarted, isAsyncSupported, isSecure, removeAttribute, setAttribute, setCharacterEncoding, startAsync, startAsync`

- - ### Field Detail

    - #### BASIC_AUTH

          static final String BASIC_AUTH

      String identifier for Basic authentication. Value "BASIC"
      See Also:
        Constant Field Values

    - #### FORM_AUTH

          static final String FORM_AUTH

      String identifier for Form authentication. Value "FORM"
      See Also:
        Constant Field Values

    - #### CLIENT_CERT_AUTH

          static final String CLIENT_CERT_AUTH

      String identifier for Client Certificate authentication. Value "CLIENT_CERT"
      See Also:
        Constant Field Values

    - #### DIGEST_AUTH

          static final String DIGEST_AUTH

      String identifier for Digest authentication. Value "DIGEST"
      See Also:
        Constant Field Values

  - ### Method Detail

    - #### getAuthType

          String getAuthType()

      Returns the name of the authentication scheme used to protect the servlet. All servlet containers support basic, form and client certificate authentication, and may additionally support digest authentication. If the servlet is not authenticated `null` is returned.

      Same as the value of the CGI variable AUTH_TYPE.

      Returns:
        one of the static members BASIC_AUTH, FORM_AUTH, CLIENT_CERT_AUTH, DIGEST_AUTH (suitable for == comparison) or the container-specific string indicating the authentication scheme, or `null` if the request was not authenticated.

    - #### getCookies

          Cookie[] getCookies()

      Returns an array containing all of the `Cookie` objects the client sent with this request. This method returns `null` if no cookies were sent.
      Returns:
        an array of all the `Cookies` included with this request, or `null` if the request has no cookies

    - #### getDateHeader

          long getDateHeader(String name)

      Returns the value of the specified request header as a `long` value that represents a `Date` object. Use this method with headers that contain dates, such as `If-Modified-Since`.

      The date is returned as the number of milliseconds since January 1, 1970 GMT. The header name is case insensitive.

      If the request did not have a header of the specified name, this method returns -1. If the header can't be converted to a date, the method throws an `IllegalArgumentException`.

      Parameters:
        `name` - a `String` specifying the name of the header
      Returns:
        a `long` value representing the date specified in the header expressed as the number of milliseconds since January 1, 1970 GMT, or -1 if the named header was not included with the request
      Throws:
        `IllegalArgumentException` - If the header value can't be converted to a date

    - #### getHeader

          String getHeader(String name)

      Returns the value of the specified request header as a `String`. If the request did not include a header of the specified name, this method returns `null`. If there are multiple headers with the same name, this method returns the first head in the request. The header name is case insensitive. You can use this method with any request header.
      Parameters:
        `name` - a `String` specifying the header name
      Returns:
        a `String` containing the value of the requested header, or `null` if the request does not have a header of that name

    - #### getHeaders

          Enumeration<String> getHeaders(String name)

      Returns all the values of the specified request header as an `Enumeration` of `String` objects.

      Some headers, such as `Accept-Language` can be sent by clients as several headers each with a different value rather than sending the header as a comma separated list.

      If the request did not include any headers of the specified name, this method returns an empty `Enumeration`. The header name is case insensitive. You can use this method with any request header.

      Parameters:
        `name` - a `String` specifying the header name
      Returns:
        an `Enumeration` containing the values of the requested header. If the request does not have any headers of that name return an empty enumeration. If the container does not allow access to header information, return null

    - #### getHeaderNames

          Enumeration<String> getHeaderNames()

      Returns an enumeration of all the header names this request contains. If the request has no headers, this method returns an empty enumeration.

      Some servlet containers do not allow servlets to access headers using this method, in which case this method returns `null`

      Returns:
        an enumeration of all the header names sent with this request; if the request has no headers, an empty enumeration; if the servlet container does not allow servlets to use this method, `null`

    - #### getIntHeader

          int getIntHeader(String name)

      Returns the value of the specified request header as an `int`. If the request does not have a header of the specified name, this method returns -1. If the header cannot be converted to an integer, this method throws a `NumberFormatException`.

      The header name is case insensitive.

      Parameters:
        `name` - a `String` specifying the name of a request header
      Returns:
        an integer expressing the value of the request header or -1 if the request doesn't have a header of this name
      Throws:
        `NumberFormatException` - If the header value can't be converted to an `int`

    - #### getMethod

          String getMethod()

      Returns the name of the HTTP method with which this request was made, for example, GET, POST, or PUT. Same as the value of the CGI variable REQUEST_METHOD.
      Returns:
        a `String` specifying the name of the method with which this request was made

    - #### getPathInfo

          String getPathInfo()

      Returns any extra path information associated with the URL the client sent when it made this request. The extra path information follows the servlet path but precedes the query string and will start with a "/" character.

      This method returns `null` if there was no extra path information.

      Same as the value of the CGI variable PATH_INFO.

      Returns:
        a `String`, decoded by the web container, specifying extra path information that comes after the servlet path but before the query string in the request URL; or `null` if the URL does not have any extra path information

    - #### getPathTranslated

          String getPathTranslated()

      Returns any extra path information after the servlet name but before the query string, and translates it to a real path. Same as the value of the CGI variable PATH_TRANSLATED.

      If the URL does not have any extra path information, this method returns `null` or the servlet container cannot translate the virtual path to a real path for any reason (such as when the web application is executed from an archive). The web container does not decode this string.

      Returns:
        a `String` specifying the real path, or `null` if the URL does not have any extra path information

    - #### getContextPath

          String getContextPath()

      Returns the portion of the request URI that indicates the context of the request. The context path always comes first in a request URI. The path starts with a "/" character but does not end with a "/" character. For servlets in the default (root) context, this method returns "". The container does not decode this string.

      It is possible that a servlet container may match a context by more than one context path. In such cases this method will return the actual context path used by the request and it may differ from the path returned by the `ServletContext.getContextPath()` method. The context path returned by `ServletContext.getContextPath()` should be considered as the prime or preferred context path of the application.

      Returns:
        a `String` specifying the portion of the request URI that indicates the context of the request
      See Also:
        `ServletContext.getContextPath()`

    - #### getQueryString

          String getQueryString()

      Returns the query string that is contained in the request URL after the path. This method returns `null` if the URL does not have a query string. Same as the value of the CGI variable QUERY_STRING.
      Returns:
        a `String` containing the query string or `null` if the URL contains no query string. The value is not decoded by the container.

    - #### getRemoteUser

          String getRemoteUser()

      Returns the login of the user making this request, if the user has been authenticated, or `null` if the user has not been authenticated. Whether the user name is sent with each subsequent request depends on the browser and type of authentication. Same as the value of the CGI variable REMOTE_USER.
      Returns:
        a `String` specifying the login of the user making this request, or `null` if the user login is not known

    - #### isUserInRole

          boolean isUserInRole(String role)

      Returns a boolean indicating whether the authenticated user is included in the specified logical "role". Roles and role membership can be defined using deployment descriptors. If the user has not been authenticated, the method returns `false`.

      The role name “*” should never be used as an argument in calling `isUserInRole`. Any call to `isUserInRole` with “*” must return false. If the role-name of the security-role to be tested is “**”, and the application has NOT declared an application security-role with role-name “**”, `isUserInRole` must only return true if the user has been authenticated; that is, only when `getRemoteUser()` and `getUserPrincipal()` would both return a non-null value. Otherwise, the container must check the user for membership in the application role.

      Parameters:
        `role` - a `String` specifying the name of the role
      Returns:
        a `boolean` indicating whether the user making this request belongs to a given role; `false` if the user has not been authenticated

    - #### getUserPrincipal

          Principal getUserPrincipal()

      Returns a `java.security.Principal` object containing the name of the current authenticated user. If the user has not been authenticated, the method returns `null`.
      Returns:
        a `java.security.Principal` containing the name of the user making this request; `null` if the user has not been authenticated

    - #### getRequestedSessionId

          String getRequestedSessionId()

      Returns the session ID specified by the client. This may not be the same as the ID of the current valid session for this request. If the client did not specify a session ID, this method returns `null`.
      Returns:
        a `String` specifying the session ID, or `null` if the request did not specify a session ID
      See Also:
        `isRequestedSessionIdValid()`

    - #### getRequestURI

          String getRequestURI()

      Returns the part of this request's URL from the protocol name up to the query string in the first line of the HTTP request. The web container does not decode this String. For example:

      First line of HTTP request | Returned Value
      --- | ---
      POST /some/path.html HTTP/1.1 |  | /some/path.html
      GET http://foo.bar/a.html HTTP/1.0 |  | /a.html
      HEAD /xyz?a=b HTTP/1.1 |  | /xyz

      To reconstruct an URL with a scheme and host, use `HttpUtils.getRequestURL(javax.servlet.http.HttpServletRequest)`.

      Returns:
        a `String` containing the part of the URL from the protocol name up to the query string
      See Also:
        `HttpUtils.getRequestURL(javax.servlet.http.HttpServletRequest)`

    - #### getRequestURL

          StringBuffer getRequestURL()

      Reconstructs the URL the client used to make the request. The returned URL contains a protocol, server name, port number, and server path, but it does not include query string parameters.

      If this request has been forwarded using `RequestDispatcher.forward(javax.servlet.ServletRequest, javax.servlet.ServletResponse)`, the server path in the reconstructed URL must reflect the path used to obtain the RequestDispatcher, and not the server path specified by the client.

      Because this method returns a `StringBuffer`, not a string, you can modify the URL easily, for example, to append query parameters.

      This method is useful for creating redirect messages and for reporting errors.

      Returns:
        a `StringBuffer` object containing the reconstructed URL

    - #### getServletPath

          String getServletPath()

      Returns the part of this request's URL that calls the servlet. This path starts with a "/" character and includes either the servlet name or a path to the servlet, but does not include any extra path information or a query string. Same as the value of the CGI variable SCRIPT_NAME.

      This method will return an empty string ("") if the servlet used to process this request was matched using the "/*" pattern.

      Returns:
        a `String` containing the name or path of the servlet being called, as specified in the request URL, decoded, or an empty string if the servlet used to process the request is matched using the "/*" pattern.

    - #### getSession

          HttpSession getSession(boolean create)

      Returns the current `HttpSession` associated with this request or, if there is no current session and `create` is true, returns a new session.

      If `create` is `false` and the request has no valid `HttpSession`, this method returns `null`.

      To make sure the session is properly maintained, you must call this method before the response is committed. If the container is using cookies to maintain session integrity and is asked to create a new session when the response is committed, an IllegalStateException is thrown.

      Parameters:
        `create` - `true` to create a new session for this request if necessary; `false` to return `null` if there's no current session
      Returns:
        the `HttpSession` associated with this request or `null` if `create` is `false` and the request has no valid session
      See Also:
        `getSession()`

    - #### getSession

          HttpSession getSession()

      Returns the current session associated with this request, or if the request does not have a session, creates one.
      Returns:
        the `HttpSession` associated with this request
      See Also:
        `getSession(boolean)`

    - #### changeSessionId

          String changeSessionId()

      Change the session id of the current session associated with this request and return the new session id.
      Returns:
        the new session id
      Throws:
        `IllegalStateException` - if there is no session associated with the request
      Since:
        Servlet 3.1

    - #### isRequestedSessionIdValid

          boolean isRequestedSessionIdValid()

      Checks whether the requested session ID is still valid.

      If the client did not specify any session ID, this method returns `false`.

      Returns:
        `true` if this request has an id for a valid session in the current session context; `false` otherwise
      See Also:
        `getRequestedSessionId()`, `getSession(boolean)`, `HttpSessionContext`

    - #### isRequestedSessionIdFromCookie

          boolean isRequestedSessionIdFromCookie()

      Checks whether the requested session ID came in as a cookie.
      Returns:
        `true` if the session ID came in as a cookie; otherwise, `false`
      See Also:
        `getSession(boolean)`

    - #### isRequestedSessionIdFromURL

          boolean isRequestedSessionIdFromURL()

      Checks whether the requested session ID came in as part of the request URL.
      Returns:
        `true` if the session ID came in as part of a URL; otherwise, `false`
      See Also:
        `getSession(boolean)`

    - #### isRequestedSessionIdFromUrl

          boolean isRequestedSessionIdFromUrl()

      Deprecated. As of Version 2.1 of the Java Servlet API, use `isRequestedSessionIdFromURL()` instead.

    - #### authenticate

          boolean authenticate(HttpServletResponse response)
                               throws IOException,
                                      ServletException

      Use the container login mechanism configured for the `ServletContext` to authenticate the user making this request.

      This method may modify and commit the argument `HttpServletResponse`.

      Parameters:
        `response` - The `HttpServletResponse` associated with this `HttpServletRequest`
      Returns:
        `true` when non-null values were or have been established as the values returned by `getUserPrincipal`, `getRemoteUser`, and `getAuthType`. Return `false` if authentication is incomplete and the underlying login mechanism has committed, in the response, the message (e.g., challenge) and HTTP status code to be returned to the user.
      Throws:
        `IOException` - if an input or output error occurred while reading from this request or writing to the given response
        `IllegalStateException` - if the login mechanism attempted to modify the response and it was already committed
        `ServletException` - if the authentication failed and the caller is responsible for handling the error (i.e., the underlying login mechanism did NOT establish the message and HTTP status code to be returned to the user)
      Since:
        Servlet 3.0

    - #### login

          void login(String username,
                   String password)
                     throws ServletException

      Validate the provided username and password in the password validation realm used by the web container login mechanism configured for the `ServletContext`.

      This method returns without throwing a `ServletException` when the login mechanism configured for the `ServletContext` supports username password validation, and when, at the time of the call to login, the identity of the caller of the request had not been established (i.e, all of `getUserPrincipal`, `getRemoteUser`, and `getAuthType` return null), and when validation of the provided credentials is successful. Otherwise, this method throws a `ServletException` as described below.

      When this method returns without throwing an exception, it must have established non-null values as the values returned by `getUserPrincipal`, `getRemoteUser`, and `getAuthType`.

      Parameters:
        `username` - The `String` value corresponding to the login identifier of the user.
        `password` - The password `String` corresponding to the identified user.
      Throws:
        `ServletException` - if the configured login mechanism does not support username password authentication, or if a non-null caller identity had already been established (prior to the call to login), or if validation of the provided username and password fails.
      Since:
        Servlet 3.0

    - #### logout

          void logout()
                      throws ServletException

      Establish `null` as the value returned when `getUserPrincipal`, `getRemoteUser`, and `getAuthType` is called on the request.
      Throws:
        `ServletException` - if logout fails
      Since:
        Servlet 3.0

    - #### getParts

          Collection<Part> getParts()
                                    throws IOException,
                                           ServletException

      Gets all the `Part` components of this request, provided that it is of type `multipart/form-data`.

      If this request is of type `multipart/form-data`, but does not contain any `Part` components, the returned `Collection` will be empty.

      Any changes to the returned `Collection` must not affect this `HttpServletRequest`.

      Returns:
        a (possibly empty) `Collection` of the `Part` components of this request
      Throws:
        `IOException` - if an I/O error occurred during the retrieval of the `Part` components of this request
        `ServletException` - if this request is not of type `multipart/form-data`
        `IllegalStateException` - if the request body is larger than `maxRequestSize`, or any `Part` in the request is larger than `maxFileSize`, or there is no `@MultipartConfig` or `multipart-config` in deployment descriptors
      Since:
        Servlet 3.0
      See Also:
        `MultipartConfig.maxFileSize()`, `MultipartConfig.maxRequestSize()`

    - #### getPart

          Part getPart(String name)
                       throws IOException,
                              ServletException

      Gets the `Part` with the given name.
      Parameters:
        `name` - the name of the requested `Part`
      Returns:
        The `Part` with the given name, or `null` if this request is of type `multipart/form-data`, but does not contain the requested `Part`
      Throws:
        `IOException` - if an I/O error occurred during the retrieval of the requested `Part`
        `ServletException` - if this request is not of type `multipart/form-data`
        `IllegalStateException` - if the request body is larger than `maxRequestSize`, or any `Part` in the request is larger than `maxFileSize`, or there is no `@MultipartConfig` or `multipart-config` in deployment descriptors
      Since:
        Servlet 3.0
      See Also:
        `MultipartConfig.maxFileSize()`, `MultipartConfig.maxRequestSize()`

    - #### upgrade

          <T extends HttpUpgradeHandler> T upgrade(Class<T> handlerClass)
                                               throws IOException,
                                                      ServletException

      Create an instance of `HttpUpgradeHandler` for an given class and uses it for the http protocol upgrade processing.
      Parameters:
        `handlerClass` - The `HttpUpgradeHandler` class used for the upgrade.
      Returns:
        an instance of the `HttpUpgradeHandler`
      Throws:
        `IOException` - if an I/O error occurred during the upgrade
        `ServletException` - if the given `handlerClass` fails to be instantiated
      Since:
        Servlet 3.1
      See Also:
        `HttpUpgradeHandler`, `WebConnection`

Copyright © 1996-2013, Oracle and/or its affiliates. All Rights Reserved. Use is subject to license terms.