System.setProperty("sun.net.http.allowRestrictedHeaders", "true") is not working in jenkins

Question

I am trying to send origin header in http request header but when I am getting its value I am getting null instead of the url that I had set in origin header.

Also I have enabled the restricted headers to be send as part of request header in jenkins job by using the following

System.setProperty("sun.net.http.allowRestrictedHeaders", "true")

But it seems that this command is not working.

Answer 1

I have run into the same problem, and what worked for me was setting the system parameter in the surefire-plugin configuration in pom.xml:

<build>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <version>2.17</version>
            <configuration>
                <systemPropertyVariables>
                    <sun.net.http.allowRestrictedHeaders>true</sun.net.http.allowRestrictedHeaders>
                </systemPropertyVariables>
            </configuration>
        </plugin>
    </plugins>
</build>

Answer 2

The root cause for not working in Jenkins job is probably your Jenkins instance is using OpenJDK to build the project.

In below source code from OpenJDK 7, it shows that it's using a static block to set allowedRestrictedHeaders system property and won't be reset after HttpURLConnection being initialized.

It would work also if you set below JVM arg besides the pom.xml solution.

"-Dsun.net.http.allowRestrictedHeaders=true"

static {
    maxRedirects = java.security.AccessController.doPrivileged(
            new sun.security.action.GetIntegerAction(
                    "http.maxRedirects", defaultmaxRedirects)).intValue();
    version = java.security.AccessController.doPrivileged(
            new sun.security.action.GetPropertyAction("java.version"));
    String agent = java.security.AccessController.doPrivileged(
            new sun.security.action.GetPropertyAction("http.agent"));
    if (agent == null) {
        agent = "Java/" + version;
    } else {
        agent = agent + " Java/" + version;
    }
    userAgent = agent;
    validateProxy = java.security.AccessController.doPrivileged(
            new sun.security.action.GetBooleanAction(
                    "http.auth.digest.validateProxy")).booleanValue();
    validateServer = java.security.AccessController.doPrivileged(
            new sun.security.action.GetBooleanAction(
                    "http.auth.digest.validateServer")).booleanValue();

    enableESBuffer = java.security.AccessController.doPrivileged(
            new sun.security.action.GetBooleanAction(
                    "sun.net.http.errorstream.enableBuffering")).booleanValue();
    timeout4ESBuffer = java.security.AccessController.doPrivileged(
            new sun.security.action.GetIntegerAction(
                    "sun.net.http.errorstream.timeout", 300)).intValue();
    if (timeout4ESBuffer <= 0) {
        timeout4ESBuffer = 300; // use the default
    }

    bufSize4ES = java.security.AccessController.doPrivileged(
            new sun.security.action.GetIntegerAction(
                    "sun.net.http.errorstream.bufferSize", 4096)).intValue();
    if (bufSize4ES <= 0) {
        bufSize4ES = 4096; // use the default
    }

    allowRestrictedHeaders = ((Boolean) java.security.AccessController.doPrivileged(
            new sun.security.action.GetBooleanAction(
                    "sun.net.http.allowRestrictedHeaders"))).booleanValue();
    if (!allowRestrictedHeaders) {
        restrictedHeaderSet = new HashSet<String>(restrictedHeaders.length);
        for (int i = 0; i < restrictedHeaders.length; i++) {
            restrictedHeaderSet.add(restrictedHeaders[i].toLowerCase());
        }
    } else {
        restrictedHeaderSet = null;
    }
}

Answer 3

I am adding to the answers by Cady and Hank:

If you are using sun.net.www.protocol.http.HttpURLConnection to perform the request (I did by using the spring boot TestRestTemplate) the system property is only read once statically.

This means, that setting the property right before performing the request may not affect HttpURLConnection although it changes the system property value.

So make sure to set it as early as possible (e.g. by Maven)