Jakarta EE 9.1 support and configurable response headers in Open Liberty 21.0.0.12

If you’re using Maven, here are the coordinates:

Or for Gradle:

Or if you’re using Docker:

Or take a look at our Downloads page.

You can now configure Open Liberty to modify response headers. The available configuration options allow for headers to be appended, for existing headers to be overwritten, for missing headers to be added, and for undesired headers to be removed from all responses being serviced by an HTTP endpoint. This configuration offers more granular control over response headers, which offers a solution to modifying headers without the need to change existing applications, filters, or otherwise.

To use configurable response headers, begin by defining a new element called <headers> in the server.xml. You can configure this for individual HTTP endpoints or for all endpoints at once.

Configuring for individual HTTP endpoints:

Configuring for all HTTP endpoints:

The add attribute allows multiple headers with the same name to be added to a response, similar to the HttpServletResponse’s addHeader API. Similarly, the set attribute is analogous to the setHeader API, which sets a response header to the given name and value. This overwrites existing headers that share the same name. The setIfMissing attribute will only set the configured headers if they are not already present on the response. Lastly, the remove attribute will remove any response headers whose name matches a name defined by the configuration.

Each header entry for the add, set, and setIfMissing attributes can be provided as a stand-alone header name. Optionally, a header value can be added by appending the colon : character after every header name. Note, however, that the remove attribute only expects header names and not a header name:value pair.

As seen in the example above, one way to configure the <headers> element is to declare each individual header within it own add, set, setIfMissing, or remove attribute. In addition to this configuration, headers can be provided as a comma delimited list.

The following server.xml configuration declares individual headers within the desired configuration attributes:

This configuration can also be declared as comma delimited lists, such as:

There are three warning messages relating to misconfigurations for this feature. Note that if a configuration value is considered to be misconfigured, it will not be utilized. Furthermore, if the misconfigured value had a non-empty header name, any further configurations with this same name will also be ignored.

The first warning message, CWWKT0042W, will be logged whenever a header name is left empty. While header values are completely optional, the configuration does expect a non-empty header name.

The add configuration allows for multiple headers with the same name to be configured. However, it would be ambiguous to repeat a header name in any other configuration attribute. For instance, consider the set attribute option, which is meant to overwrite an existing header that shared the declared header name. If the set configuration contained two headers with the same name, it would be unclear which of the two values should be chosen. Similarly, if the same header name is present in two or more configurations, the same ambiguity is true. As such, and excluding repetitions in the add configuration, whenever a header name is found to be used more than once, the warning message CWWKT0043W will be logged.

The third warning message, CWWKT0044W, is logged if a header that has already been flagged as a duplicate by the CWWKT0043W warning message, continues to be utilized by further configurations.

Warning Message Descriptions:

CWWKT0042W : An empty header name was found when the 'set` configuration was parsed. This value is ignored.

CWWKT0043W : A duplicate header name was found in the [foo] header using the set configuration. All configurations for the [foo] header are ignored. Any header that is defined by the remove, add, set, or setIfMissing configurations must be unique across all configurations.

CWWKT0044W : The [foo] header, which is marked as a duplicate header name, was found in the set configuration. The [foo] header is ignored. Any header that is defined by the set configuration must contain unique header names.

Summary

Open Liberty now provides a way to control response headers for a given HTTP endpoint. These can be appended, configured to overwrite, to only be added if not already present, or completely removed from all responses. Try it out for yourself!

We’ve spent some time fixing bugs. The following sections describe just some of the issues resolved in this release. If you’re interested, here’s the full list of bugs fixed in 21.0.0.12.

As Open Liberty features and functionality continue to grow, we continue to add new guides to openliberty.io on those topics to make their adoption as easy as possible. Existing guides also receive updates in order to address any reported bugs/issues, keep their content current, and expand what their topic covers.

Available through Maven, Gradle, Docker, and as a downloadable archive.