var req = IHttpServletRoundtrip.CURRENT_HTTP_SERVLET_REQUEST.get();

req.getHeader("headername");
req.getHeaderNames();
req.getHeaders("headername");

package cz.a4b.tracetickets.ui.html;

@Replace
public class MyUiSession extends UiSession {
	@Override
	protected IClientSession createAndStartClientSession(Locale locale, UserAgent userAgent,
			Map<String, String> sessionStartupParams) {
		HttpServletRequest req = currentHttpRequest();
		StringBuilder sb = new StringBuilder();
		
		sb.append("--- Header ---").append("\r\n");
		Enumeration<String> headernames = req.getHeaderNames();
		while (headernames.hasMoreElements()) {
		    String param = headernames.nextElement();
		    sb.append(param + "=" + req.getHeader(param)).append("\r\n");
		}
		
		sb.append("--- Attributes ---").append("\r\n");
		Enumeration<String> attributenames = req.getAttributeNames();
		while (attributenames.hasMoreElements()) {
		    String param = attributenames.nextElement();
		    sb.append(param + "=" + req.getAttribute(param)).append("\r\n");
		}
		
		sb.append("--- Parameters ---").append("\r\n");
		Map<String, String[]> parametermap = req.getParameterMap();
		for(String key : parametermap.keySet()) {
			String[] val = parametermap.get(key);
			sb.append(key + "=[" + String.join(",", val) + "]").append("\r\n");
		}

		sb.append("--- Cookies ---").append("\r\n");
		Cookie[] cookies = req.getCookies();
		for(Cookie c : cookies) {
			sb.append(c.getName() + "=" + c.getValue()).append("\r\n");
		}
		
		sb.append("--- Others ---").append("\r\n");
		sb.append("remoteAddr=" + req.getRemoteAddr()).append("\r\n");
		sb.append("remoteHost=" + req.getRemoteHost()).append("\r\n");
		sb.append("remoteUser=" + req.getRemoteUser()).append("\r\n");
		sb.append("authType=" + req.getAuthType()).append("\r\n");
		sb.append("localName=" + req.getLocalName()).append("\r\n");
		Principal userprincipal = req.getUserPrincipal();
		sb.append("userPrincipal.Name=" + userprincipal.getName()).append("\r\n");		
		
		Map<String, String> modifableMap = new HashMap<>(sessionStartupParams);
	    modifableMap.put("header", sb.toString());
		return super.createAndStartClientSession(locale, userAgent, modifableMap);
	}
}

package cz.a4b.tracetickets.client;

public class ClientSession extends AbstractClientSession {
	...

	@Override
	protected void execLoadSession() {
		LOG.info("ClientSession execLoadSession");
		// pre-load all known code types
		CODES.getAllCodeTypes("cz.a4b.tracetickets.shared");
		
		PropertyMap pm = PropertyMap.CURRENT.get();
		setData("header", pm.get("header"));
		
		initializeSharedVariables();

		...
		
		setDesktop(new Desktop());
	}

	...
}	

String res = (String) ClientSession.get().getData("header");
MessageBoxes.createOk().withHeader(res).show();

@TunnelToServer
public class DataSourceCredentialVerifier extends Crypter implements ICredentialVerifier {

public class UiServletFilter implements Filter {

	private TrivialAccessController m_trivialAccessController;
	private FormBasedAccessController m_formBasedAccessController;
	private DevelopmentAccessController m_developmentAccessController;

	@Override
	public void init(FilterConfig filterConfig) throws ServletException {
		m_trivialAccessController = BEANS.get(TrivialAccessController.class).init(new TrivialAuthConfig().withExclusionFilter(filterConfig.getInitParameter("filter-exclude")).withLoginPageInstalled(true));
		m_formBasedAccessController = BEANS.get(FormBasedAccessController.class).init(new FormBasedAuthConfig().withCredentialVerifier(BEANS.get(DataSourceCredentialVerifier.class)));
		m_developmentAccessController = BEANS.get(DevelopmentAccessController.class).init();
	}

@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
		final HttpServletRequest req = (HttpServletRequest) request;
		final HttpServletResponse resp = (HttpServletResponse) response;

		if (m_trivialAccessController.handle(req, resp, chain)) {
			return;
		}

		if (m_formBasedAccessController.handle(req, resp, chain)) {
			return;
		}

		/*if (m_developmentAccessController.handle(req, resp, chain)) {
			return;
		}*/

		if (req.getPathInfo() != null && req.getPathInfo().startsWith("/unload/")) {
			resp.sendError(HttpServletResponse.SC_FORBIDDEN);
			return;
		}

		BEANS.get(ServletFilterHelper.class).forwardToLoginForm(req, resp);
	}

	@Override
	public void destroy() {
		m_developmentAccessController.destroy();
		m_formBasedAccessController.destroy();
		m_trivialAccessController.destroy();
	}