[jsr369-experts] Re: [servlet-spec users] [SPEC-159] HttpServletResponse.setHeader() and null

From: Mark Thomas <markt_at_apache.org>
Date: Wed, 7 Sep 2016 16:46:12 +0100

On 07/09/2016 16:35, Edward Burns wrote:
> I've added the agreed upon changes to setHeader and containsHeader to
> the JIRA. What remains is the matter addressed by this text:
> SD> On 5 September 2016 at 10:05, Stuart Douglas <sdouglas_at_redhat.com> wrote:
> SD> "Containers may still add or modify headers before the response is
> SD> committed. These will generally be headers that are required at a
> SD> protocol level."
> SD>
> Do we specifically need to account for the case of collision between a
> header set by the app and one that is set by the container? If so, we
> must decide who wins, the container or the app. I judge the app should
> win. If so, the text could be rewritten as:
> Containers retain the right to add or modify headers before the
> response is committed. If a header is explicitly set by the
> application, containers must not change the header set in this way.
> I don't see the need for a statement about what sorts of headers the
> container generally needs to add.
> Thoughts?

-1. The container should win. It will only be setting protocol required
headers and those are something the application should not be
interfering with.