title: Why does a redirect come with previous request headers
body: <p>I’m having an issue figuring out why the sendRedirect method sends previous headers when the browser is supposed to issue a request with a brand new request and response objects.</p>
  
  <p>If I give a bit of background information, we are using a JAVA CMS platform that dumps the stack trace in some rare cases disclosing the technology being used. This was found by pen testing and considered as a security threat. So we have been advised to fix it by displaying a normal error page.</p>
  
  <p>The following is a screenshot of the request I use to reproduce this issue.
  <a href="https://i.stack.imgur.com/VJGHZ.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VJGHZ.jpg" alt="enter image description here"></a></p>
  
  <p>When a request is made it goes through the filter chain of the CMS. This issue happened in one of the filters in the CMS platform filter chain. Therefore I have created the following custom filter and made it as the first filter so that any request first goes this custom filter before it hits the CMS platform filter chain. And it is the last one when going back to the client.  This filter kind of a pass through filter and doesn’t do any processing. The one and only job is to redirect to the generic error page if something goes wrong anywhere in the chain.</p>
  
  <p>I’m trying to redirect to a page which is hosted in the CMS. What happens is when the redirected request hits the server it contains the old request headers and when it goes through the filter chain this issue happens again and again.</p>
  
  <p><strong>Note</strong>: I can’t avoid the CMS platform filter chain as it is the one which constructs the page dynamically from JCR (java content repository)</p>
  
  <pre><code>public class CPSFirstFilter implements Filter {
  
      private static final Logger log =    LoggerFactory.getLogger(CPSFirstFilter.class);
      @Override
      public void init(FilterConfig filterConfig) throws ServletException {
      }
  
      @SuppressWarnings("unchecked")
      @Override
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
          throws IOException, ServletException {
  
      HttpServletRequest httpServletRequest = null;
      HttpServletResponse httpServletResponse = null;
  
      try {
          httpServletRequest = (HttpServletRequest) request;
  
          //TETSing. This is how I found out that second request has previous headers
          Enumeration headerNames = httpServletRequest.getHeaderNames();
          while (headerNames.hasMoreElements()) {
              String key = (String) headerNames.nextElement();
              String value = httpServletRequest.getHeader(key);
              System.out.println("Key : " + key + " Value : " + value);
          }
  
          chain.doFilter(request, response) 
  
      } catch (Exception e) {
          log.error("Logging from XSSFilter: " + e.getMessage());
          // Redirecting
          httpServletResponse.sendRedirect(getRequestURL(httpServletRequest, "/500-internal-error.html"));
          return;
         }
      }
  
      @Override
      public void destroy() {
      }
  
  
      private String getRequestURL(HttpServletRequest request, String destination) {
  
          String url = request.getRequestURL().toString();
          String uri = request.getRequestURI();
          String ctx = request.getContextPath();
          String base = url.substring(0, url.length() - uri.length()) + ctx;
          System.out.println("2: " + base + destination);
          return base + destination;
        }
  
  
  }
  </code></pre>
  
  <p>Why does the redirect request has previous headers and is there a way to clear them? Any better way to handle headers?</p>
  
  <p>If I can clear the old headers and then I can send the second request for the web page through the CMS filter chain and it will serve the error page without any issue.</p>
  
  <p>Second option is to create a static html web page and avoid the filter chain when redirecting to this page. The client doesn’t like the second option</p>
  
  <p>Note: I think the following should also work without explicit redirect if I can get rid of previous headers.</p>
  
  <pre><code> &lt;error-page&gt;
      &lt;error-code&gt;500&lt;/error-code&gt;
      &lt;location&gt;/500-internal-error.html&lt;/location&gt;
   &lt;/error-page&gt;
  </code></pre>