title: Why are some of the headers restricted in HttpURLConnection after JDK 1.6?
body: <p><strong>Need a deeper understanding on this topic</strong>.</p>
  
  <p>I tried to lookup for specific reasons in documentations for the restricted headers but couldn't find one.</p>
  
  <p>Here is a list of restricted headers:</p>
  
  <p><code>Accept-Charset</code>
  <code>Accept-Encoding</code>
  <code>Access-Control-Request-Headers</code>
  <code>Access-Control-Request-Method</code>
  <code>Connection</code>
  <code>Content-Length</code>
  <code>Cookie</code>
  <code>Cookie2</code>
  <code>Date</code>
  <code>DNT</code>
  <code>Expect</code>
  <code>Host</code>
  <code>Keep-Alive</code>
  <code>Origin</code>
  <code>Referer</code>
  <code>TE</code>
  <code>Trailer</code>
  <code>Transfer-Encoding</code>
  <code>Upgrade</code>
  <code>Via</code></p>
  
  <p><strong>refer</strong>: <a href="http://hg.openjdk.java.net/jdk8u/jdk8u-dev/jdk/file/31bc1a681b51/src/share/classes/sun/net/www/protocol/http/HttpURLConnection.java#l186" rel="nofollow noreferrer">http://hg.openjdk.java.net/jdk8u/jdk8u-dev/jdk/file/31bc1a681b51/src/share/classes/sun/net/www/protocol/http/HttpURLConnection.java#l186</a></p>
  
  <p>To override these it is required to set <strong>sun.net.http.allowrestrictedheaders</strong> to <strong>true</strong> at JVM startup or use
  <strong>System.setProperty("sun.net.http.allowRestrictedHeaders", "true")</strong></p>
  
  <p>It is said that it has been disabled as part of a security-fix.</p>
  
  <p><strong>I want to understand what security risk might have pulled up and how was making headers forbidden to use was a solution to that, keeping in mind you still can override the headers.</strong> </p>
  
  <p><strong>links to refer:</strong></p>
  
  <p><a href="https://fetch.spec.whatwg.org/#forbidden-header-name" rel="nofollow noreferrer">https://fetch.spec.whatwg.org/#forbidden-header-name</a></p>
  
  <p><a href="https://stackoverflow.com/questions/6056125/why-does-content-length-http-header-field-use-a-value-other-than-the-one-given-i/6056230#6056230">Why does Content-Length HTTP header field use a value other than the one given in Java code?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/7648872/can-i-override-the-host-header-where-using-javas-httpurlconnection-class">Can I override the Host header where using java&#39;s HttpUrlConnection class?</a></p>