Control Information: HTTP Headers and HTTP Response Codes

When a browser issues a page request to a Web server, the server responds by sending back HTML and images for the browser to display. But, in addition to the HTML and images, control information in the form of HTTP headers and HTTP response codes are a big part of the HTTP conversation. This was demonstrated in the previous sections where each request had response code and control information included in the response.

HTTP Response Codes

HTTP response codes are how the Web server communicates the status of a request to the browser. All response codes are defined in the HTTP specifications (HTTP 1.1 codes are covered in RFC 2616). Categories of possible responses are

Informational: Responses in the 100s provide information to the requesting client on the status of a request. These didn't exist before HTTP 1.1 and are not commonly used.
Successful: Responses in the 200s indicate that the request was received, understood , and accepted by the server.
Redirection: Responses in the 300s indicate the resource requested exists at a different location. For example, a request for the resource / may be redirected to the resource /index.html .
Client Error: Responses in the 400s indicate an error of some sort on the part of the client. For example, the client might have requested a resource that doesn't exist or one that the client isn't authorized for.
Server Error: Responses in the 500s indicate an error was encountered on the server while trying to fulfill the request. For example, a servlet or JSP page might have thrown an exception during processing.

As you saw for each of the examples earlier in this chapter, the first line of each response was HTTP/1.1 200 OK . This is the standard response when a request is processed correctly.

To demonstrate a different result, consider the JSP code in Listing 4.3.

Listing 4.3 A Sample JSP File That Throws an Exception ( `throwIt.jsp` )

 <html>   <head>     <title>Throw an Exception!</title>   </head>   <body>     <%       boolean throwIt = true;       if (throwIt) {         throw new Exception();       }     %>   </body> </html>

This JSP file will compile correctly and throw an exception at run-time. Listing 4.4 shows what happens when this file is executed.

Listing 4.4 Requesting the `throwIt.jsp` File and Seeing the `500 Internal Server Error` Response.

  bash-2.05$ ./telnet -E localhost 8080  Trying 127.0.0.1... Connected to localhost. Escape character is 'off'.  GET /throwIt.jsp HTTP/1.0  HTTP/1.1 500 Internal Server Error Connection: close Set-Cookie: JSESSIONID=358F99EE5330C7B83BD2A73BE064ED0C;Path=/ <html><head><title>Apache Tomcat/4.0.3 - Error report</title> [The rest of the output is not shown...]

In this listing you see an example of the dreaded Error 500 Internal Server Error that's so familiar to JSP developers! You can see here how the errors you deal with as a Struts/JSP developer are traceable directly back to the HTTP protocol.

Table 4.1 provides a listing of useful HTTP response codes.

Table 4.1. HTTP Response Code Categories and Sample Response Codes with Descriptions

Category	Response Code	Description
1 xx	`100 Continue`	The Web server has received the initial part of the request correctly. Continue with the rest.
2 xx	`200 OK`	The request has been received and processed correctly. The response follows .
3 xx	`301 Moved`	The requested resource has moved. The new URI is provided so that the browser can issue a new request.
	`304 Not Modified`	The requested resource has not been modified. The page can safely be reloaded from cache. Commonly used when requesting images.
4 xx	`401 Unauthorized`	The requested resource requires authorization. The user should resend the request with proper credentials.
	`403 Forbidden`	The resource is not available to the user, regardless of authentication.
	`404 Not Found`	The resource requested cannot be located on this server.
5 xx	`500 Server Error`	An error occurred while the server attempted to fulfill the request.

All valid HTTP response codes are also defined as public static final int fields in javax.servlet.http.HttpServletResponse . For example, the 500 Server Error code can be represented in code as response.SC_INTERNAL_SERVER_ERROR .

HTTP Request and Response Headers

HTTP headers are control information passed between a browser and a HTTP server. They provide information such as the type of the browser making the request (Internet Explorer, Mozilla, Netscape, and so on), the number of characters being sent, and the type of data that is contained in a response (for example text/html or image/jpg ).

There are two general classes of HTTP headers: HTTP request headers and HTTP response headers. The difference between them being, of course, whether they are sent with the HTTP request or the HTTP response.

The most common HTTP headers are those defined by the HTTP protocol specification. They vary based on the version of HTTP that governs the conversation (usually HTTP 1.1, but occasionally still HTTP 1.0).

Sometimes special servers such as proxy or security servers will add additional HTTP headers for their own usage. It is not uncommon for application developers to add custom headers as well.

Cookies are a special type of a HTTP response header (the Set-Cookie header) and a HTTP request header (the Cookie header). Cookies are discussed in more detail in the next section.

Table 4.2 contains a listing of common HTTP request and response headers.

Table 4.2. Common HTTP Request and Response Headers

Header	Description
`Date`	The current date/time in GMT. The `setDateHeader()` method can be used to set this without worrying about formatting the date string.
`User-Agent`	Defines the browser type and version number.
`Set-Cookie`	Used by a server to set a cookie in the client browser.
`Cookie`	The header used by a browser to return a cookie to the server that set it.
`Host`	The hostname of the server that originated the request.
`Referrer`	The URL from which the browser that made the request was referred. Can be used to determine where traffic to a Web site came from.
`Server`	The type of server that sent the response. For example, `Apache Tomcat/4.0.3` .
`SoapAction`	Used in the SOAP protocol to tell a server which action to take to process the request.

To demonstrate how to work with HTTP headers, consider the JSP code in Listing 4.5.

Listing 4.5 A Sample JSP File for Printing All HTTP Request Headers ( `headerList.jsp` )

 <html>   <head>     <title>List all HTTP Headers</title>   </head>   <body>     <%       java.util.Enumeration e = request.getHeaderNames();       String requestHeaderName;       String requestHeaderValue;       for (int i = 0; e.hasMoreElements() ; i++ ) {         requestHeaderName = (String) e.nextElement();         requestHeaderValue = request.getHeader(requestHeaderName);         out.print("HTTP Request Header #" + i + " is ---> " );         out.print(requestHeaderName + ": " + requestHeaderValue + " <br>\n" );       }     %>   </body> </html>

All this program does is return a listing containing all the HTTP request headers included in the request. Listing 4.6 shows what happens when this file is executed.

Listing 4.6 Returning All the Headers in the HTTP Request

  bash-2.05$ ./telnet -E localhost 8080  Trying 127.0.0.1... Connected to localhost. Escape character is 'off'.  GET /headerList.jsp HTTP/1.0   TestHeader: This is a test   YetAnotherHeader: Foo  HTTP/1.1 200 OK Content-Type: text/html;charset=ISO-8859-1 Date: Sat, 29 Jun 2002 02:54:28 GMT Server: Apache Tomcat/4.0.3 (HTTP/1.1 Connector) Connection: close Set-Cookie: JSESSIONID=9F0C62A7A7BEF9D4C1D2442EE3E94B21;Path=/ <html>   <head>     <title>List all HTTP Headers</title>   </head>   <body>      HTTP Request Header #0 is ---> testheader: This is a test <br>      HTTP Request Header #1 is ---> yetanotherheader: Foo <br>   </body> </html> Connection closed by foreign host. bash-2.05$

In this request, two HTTP headers are included. Their names and values are TestHeader: This is a test and YetAnotherHeader: Foo . As you can see, HTTP headers are simply name /value pairs that are part of the information passed between browsers and HTTP servers to allow control and coordination of the HTTP request and response cycle.

Browsers submit a number of HTTP request headers with every request. Listing 4.7 shows what is displayed in a browser when the /headerList.jsp file is requested.

Listing 4.7 HTTP Request Headers Sent with a Browser Request

[View full width]

 HTTP Request Header #0 is ---> connection: Keep-Alive HTTP Request Header #1 is ---> user-agent: Mozilla/4.78 (WinNT; U) HTTP Request Header #2 is ---> pragma: no-cache HTTP Request Header #3 is ---> host: localhost:8080 HTTP Request Header #4 is ---> accept: image/gif, image/x-xbitmap, image/jpeg, image/  pjpeg, image/png, */* HTTP Request Header #5 is ---> accept-encoding: gzip HTTP Request Header #6 is ---> accept-language: en HTTP Request Header #7 is ---> accept-charset: iso-8859-1,*,utf-8 HTTP Request Header #8 is ---> cookie: JSESSIONID=3B3C644512905CD6448897A953AD8BD1

These are all the HTTP request headers that the browser sent with its request for the page.

Note

For more information on this topic, please refer to the HTTP 1.1 protocol specification (RFC 2616) located at http://www.w3.org/Protocols/rfc2616/rfc2616.html.