Injecting authentication headers using request filters? #15156

Jetty version(s)
Jetty 12.1.9

Jetty Environment
ee10, probably ee11 too

HTTP version
Shouldn't matter

Java version/vendor (use: java -version)
openjdk version "21.0.11" 2026-04-21 LTS

OS type/version
AlmaLinux 9.7 (Moss Jungle Cat)

Description
I was trying to use HttpFilters to munge some authentication headers in my requests like (dummy example):

    public static class TestFilter extends HttpFilter {
        @Override
        protected void doFilter​(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {
            req = new HttpServletRequestWrapper(req) {
                @Override
                public String getHeader(String name) {
                    if ("X-Username".equalsIgnoreCase(name)) {
                        return "admin";
                    }
                    if ("X-Password".equalsIgnoreCase(name)) {
                        return "password";
                    }
                    return super.getHeader(name);
                }
            };
            chain.doFilter(req, res);
        }
    }

but was confused to find that my authenticator wasn't seeing the results. Digging into the issue, the problem seems to be that though doGet() etc. do see the injected headers through HttpServletRequest#getHeader, when I call HttpServletRequest#authenticate on it, it is the wrapped Jetty Request that ultimately descends down to the authenticator, which obviously doesn't have those headers.

Is what I'm attempting here something that should work?

How to reproduce?
Attached is a minimal Maven project that builds an uber-jar that demonstrates the issue. Build with mvn package, run with java -jar target/jetty-request-filtering-0.0.0.jar, and navigate to http://localhost:9000/test. That page will given you 401 Unauthorized, though the filter should inject the X-Username:admin and X-Password:password headers necessary for the authentication.

jetty-request-header-filtering.zip