How to stop server header in tomcat - URGENT

[gudipati1]

Hi, I am using jboss-3.0.1_tomcat-4.0.4 combination for my application on linux. But there seems to be a security issue in this. When a user does curl -i <url> we can see the server header along with the server make and version. Is there a way I can stop this server header. I am pasting the result of the curl command here. ============================= HTTP/1.1 401 Unauthorized Content-Type: text/html Expires: Thu, 01 Jan 1970 00:00:00 GMT Date: Thu, 19 May 2005 07:12:48 GMT Pragma: No-cache Server: Apache Tomcat/4.0.4 (HTTP/1.1 Connector) Transfer-Encoding: chunked Cache-Control: no-cache

http://WWW-Authenticate:

============================= Thanks Prasad Gudipati

 

[sedj]

Please do NOT put "URGENT" in your subject heading - it will not get people to answer you any more quickly than usual - and in fact may put some people off answering you !

You can have tomcat use custom error pages for certain errors - eg, the below uses a custom page for a 404 error :

In your web.xml :

        <error-page>
            <error-code>404</error-code>
            <location>/error/404.html</location>
        </error-page>

I would try that with your 401 error ...

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[gudipati1]

Hi sedj,
Thanks for the info, 401 works. But the problem is my application uses tomat's basic authenticationi. So when I try to access my index.jsp, it takes me to unauthorized access page. Is there a round about you can think of?

 

[sedj]

Sorry, I don't quite follow - could you elaborate ?

I thought the problem was that you wanted to stop tomcat's default HTTP error pages ....

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[gudipati1]

sedj,
My main issue is, I do not want to expose the server info like "Apache Tomcat/4.0.4 (HTTP/1.1 Connector)" when the user uses any other http clients like curl. By seeing this info, user can understand which version and which make of server is my application running on. So, I could like to replace this string with some other string like <My prod name>

Regards
Prasad

 

[sedj]

Thats what my first post described how to to I believe ...

--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk