HttpUrlConnection censors some headers, notably Origin?

Question

I am trying to create some tests for web services that implement CORS. So, I need to send Origin headers. When I call addRequestProperty("origin", origin) , the source header does not appear on the server. I say “it seems” - I have a servlet repeating all the headers that print them, and it does not appear. I did not go all the way to TCPMon or sent a request through a normal socket connection.

The javadoc for the HttpUrlConnection does not mention the restrictions that I saw, but I could skip the critical sentence. Is this a known limitation?

Answer 1

I found http://javasourcecode.org/html/open-source/jdk/jdk-6u23/sun/net/www/protocol/http/HttpURLConnection.java.html .

The author, artfully, decided to ban Origin and other CORS-related headers without actually implementing the CORS specification. This is pretty depressing.