Hi,

The CDI spec defines a built-in bean for the type HttpServletRequest. In 3.8 it says:

"A servlet container must provide the following built-in beans, all of which have qualifier @Default:

a bean with bean type javax.servlet.http.HttpServletRequest, allowing injection of a reference to the HttpServletRequest"

An HttpServletRequest however can be wrapped multiple times and by multiple artefacts. I.e. by a ServerAuthModule, Filter and a RequestDispatcher.

The question now is; which version of the HttpServletRequest is supposed to be injected?

* The first one in the chain?

* The last one in the chain?

* The current one at a given point in the chain?

A little bit of experimenting seems to indicate it's now often "one of the first ones", e.g. the one that happened to be current when e.g. a ServletRequestListener that initialises a specific CDI implementation is called.

I think this is a little confusing, as working with an injected request can now totally ignore the request wrapping that has been done and break an application badly.

Thoughts?

Kind regards,

Arjan Tijms