How to remove request parameters in a filter

Question

Hello,
I wanted to make a filter that removes all the GET parameters except for a few exceptions.
How do I remove parameters from a ServletRequest or HttpServletRequest? I am trying to make a webapp that only uses POST variables, and not GET (except a few exceptions).
Can someone point me in the right direction?
Thanks!

Answer 1

Arrowx7 wrote:
Hey, thanks for the replies.
Actually, I have a bunch of action forms in my webapp, which use request.getParameter(). This method doesn't distinguish between get and post. For security reasons, I don't want any of those parameters coming in with the URL as GET.
At first I wanted to have the filter take the request URL, parse the variables, loop through them, and remove ones that aren't on the EXEMPT list.
So a request like this:
http://myweb.com/messageAction.do?method=send&to=bahuser&subject=i+am+stupid&body=you+stink
would be turned into this:
http://myweb.com/messageAction.do?method=send
because the 'method' param is the only one that is on the EXEMPT list.
Perhaps there is a way I can get the request URL with the GET params, and then redirect to the safe URL after taking out parameters?If you actually mean take out those parameters (ie make them not attainable anymore) then yes, you can do
if ("get".equals(request.getMethod().toLowerCase()) {
  response.sendRedirect("http://myweb.com/messageAction.do?method="+request.getParameter("method"));
} else {
  filterChain.doFilter(request, response);
}>
Thanks!
Edited by: Arrowx7 on Jul 24, 2008 9:03 AM