不借助HttpServletResponse移除HttpServletRequest中特定Cookie的最优方案

HttpServletRequest本身的Cookie集合是只读的，无法直接修改或移除其中的Cookie。要实现移除特定Cookie并转发请求的需求，标准做法是使用HttpServletRequestWrapper创建一个包装类，重写getCookies()方法返回过滤后的Cookie数组。

步骤1：实现自定义请求包装类 #

创建一个继承自HttpServletRequestWrapper的类，在其中过滤掉指定名称的Cookie：

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.Cookie;
import java.util.ArrayList;
import java.util.List;

public class FilteredCookieRequestWrapper extends HttpServletRequestWrapper {
    private final String cookieToRemove;

    public FilteredCookieRequestWrapper(HttpServletRequest request, String cookieToRemove) {
        super(request);
        this.cookieToRemove = cookieToRemove;
    }

    @Override
    public Cookie[] getCookies() {
        Cookie[] originalCookies = super.getCookies();
        if (originalCookies == null || cookieToRemove == null) {
            return originalCookies;
        }

        List<Cookie> filteredCookies = new ArrayList<>();
        for (Cookie cookie : originalCookies) {
            // 跳过要移除的Cookie
            if (!cookieToRemove.equals(cookie.getName())) {
                filteredCookies.add(cookie);
            }
        }

        return filteredCookies.toArray(new Cookie[0]);
    }
}

步骤2：在控制器中使用包装类处理请求 #

在你的JAX-RS控制器方法中，用包装类包裹原始请求，之后用包装后的请求进行转发操作：

场景1：转发到内部Servlet/资源 #

如果是在同一个Servlet容器内转发，直接使用包装后的请求即可：

@Path("/details")
public Response getDetails(@Context HttpServletRequest httpServletRequest, ConsumerReqBody consumerReqBody) {
    String targetCookieName = "your-cookie-name";
    // 包装原始请求，过滤掉目标Cookie
    HttpServletRequest wrappedRequest = new FilteredCookieRequestWrapper(httpServletRequest, targetCookieName);

    try {
        // 获取转发器并执行转发
        RequestDispatcher dispatcher = wrappedRequest.getRequestDispatcher("/internal/endpoint");
        // 注意：若没有HttpServletResponse，这种方式可能不适用，更推荐下面的JAX-RS Client方式
        // dispatcher.forward(wrappedRequest, response);
    } catch (Exception e) {
        // 处理异常逻辑
    }

    // 后续逻辑...
}

场景2：使用JAX-RS Client转发到外部服务器 #

如果是转发到外部服务器，从包装后的请求中取出过滤后的Cookie，逐个添加到Client请求中：

import javax.ws.rs.client.Client;
import javax.ws.rs.client.ClientBuilder;
import javax.ws.rs.client.Entity;
import javax.ws.rs.client.WebTarget;
import javax.ws.rs.core.Response;

@Path("/details")
public Response getDetails(@Context HttpServletRequest httpServletRequest, ConsumerReqBody consumerReqBody) {
    String targetCookieName = "your-cookie-name";
    HttpServletRequest wrappedRequest = new FilteredCookieRequestWrapper(httpServletRequest, targetCookieName);

    // 初始化JAX-RS Client
    Client client = ClientBuilder.newClient();
    WebTarget target = client.target("http://external-server.com/target-endpoint");
    Invocation.Builder requestBuilder = target.request();

    // 添加过滤后的Cookie到请求头
    Cookie[] filteredCookies = wrappedRequest.getCookies();
    if (filteredCookies != null) {
        for (Cookie cookie : filteredCookies) {
            requestBuilder.cookie(new javax.ws.rs.core.Cookie(cookie.getName(), cookie.getValue()));
        }
    }

    // 发送请求并获取响应
    Response forwardedResponse = requestBuilder.post(Entity.json(consumerReqBody));

    // 处理转发后的响应并返回
    return Response.status(forwardedResponse.getStatus())
                   .entity(forwardedResponse.readEntity(String.class))
                   .build();
}

核心原理 #

HttpServletRequestWrapper是Servlet API提供的标准工具，用于包装原始请求并修改其行为。通过重写getCookies()方法，我们可以在不修改原始请求的前提下，返回过滤后的Cookie集合，满足转发时移除特定Cookie的需求。

内容的提问来源于stack exchange，提问作者M.S.Naidu