You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "L. Mohan Arun" <ma...@gmail.com> on 2005/09/02 14:40:40 UTC
HTTP status code 404
Tomcat 4.1
How can I configure Tomcat 4 to return HTTP status code 404 for a "404 Page
Not Found" error? Currently it displays a HTML page with "Error type" etc.
with status code 200.
The docs say <error-page> element in web.xml can be configured to serve
another page in response to a 404 error but this is not what I want (because
it will return a 200 OK status). I want the actual error code 404 to be
returned to the client and HTTP status code 404 (Page not found).
Mohan Arun
Re: HTTP status code 404
Posted by Paul Singleton <pa...@jbgb.com>.
QM wrote:
> On Mon, Sep 05, 2005 at 06:28:05PM +0100, Paul Singleton wrote:
> : But we want *no* error page, just a 404 status returned to
> : the browser, which will then presumably present this failure
> : to the user in its own way. Or have I musunderstood 404s?
> Yes and no. Browsers are free to interpret 404s (and any other error
> code) as they see fit. For example, IE's "friendly error messages" will
> interpret the status code and show the user its own "not found" page
> instead of the data returned by the server.
> : Exactly what <error-page> element will achieve this, and
> : where should we call ...setStatus(...NOT_FOUND)?
> If you *really* want to leave this up to the browser, map the
> <error-page> to a JSP that simply sets a 404 response and returns no
> data. (I forget the exact API call for this, but it's in the
> HttpServlet or HttpServletRequest JavaDoc.)
It's in javax.servlet.http.HttpServletResponse (from 2.1), hence
<%
response.sendError(javax.servlet.http.HttpServletResponse.SC_NOT_FOUND);
%>
> ...
> The real question is, do you really want to do this?
I *really* want to return a page which gives a hacker no indication
which web app server we're using (because our client thinks this is
good security practice) without going to the trouble of writing my
own :-)
I've tried your dataless 404 suggestion, and it indeed prompts IE
to show that familiar
The page cannot be found
effort, but unfortunately Firefox shows a blank page, so just in case
there are ever any broken links in our web apps, I'd better not leave
it up to the browser, but write a (suitably anonymous) one of our own.
Many thanks for your help
Paul Singleton
--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.10.18/89 - Release Date: 2/Sep/2005
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: HTTP status code 404
Posted by QM <qm...@brandxdev.net>.
On Mon, Sep 05, 2005 at 06:28:05PM +0100, Paul Singleton wrote:
: But we want *no* error page, just a 404 status returned to
: the browser, which will then presumably present this failure
: to the user in its own way. Or have I musunderstood 404s?
Yes and no. Browsers are free to interpret 404s (and any other error
code) as they see fit. For example, IE's "friendly error messages" will
interpret the status code and show the user its own "not found" page
instead of the data returned by the server.
: Exactly what <error-page> element will achieve this, and
: where should we call ...setStatus(...NOT_FOUND)?
If you *really* want to leave this up to the browser, map the
<error-page> to a JSP that simply sets a 404 response and returns no
data. (I forget the exact API call for this, but it's in the
HttpServlet or HttpServletRequest JavaDoc.)
Another alternative would be to have the <error-page> redirect people to
the site's landing page. (The idea is, "if you've hit an invalid URL,
go back to the beginning.") I've done this before for certain sites.
The real question is, do you really want to do this?
Unless you're writing a highly specialized app, it's not nice to fool
the end-user on error conditions. The JSP that just sends a 404 may
yield "document contains no data" errors from the browser; and
redirecting people to the landing page may hide broken links (read:
developer error) and/or frustrate the user.
-QM
--
software -- http://www.brandxdev.net/
tech news -- http://www.RoarNetworX.com/
code scan -- http://www.JxRef.org/
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: HTTP status code 404
Posted by Paul Singleton <pa...@jbgb.com>.
Please help a little more; I am not sure what you mean.
The <error-page> directive as documented in SRV.9.9.2 of
the 2.4 servlet spec mentions that we can nominate a custom
error page, otherwise I understand we get Tomcat's default
one.
But we want *no* error page, just a 404 status returned to
the browser, which will then presumably present this failure
to the user in its own way. Or have I musunderstood 404s?
Exactly what <error-page> element will achieve this, and
where should we call ...setStatus(...NOT_FOUND)?
Paul Singleton
Mirek Stohr wrote:
> You should use the following procedure
>
> HttpServletResponse.setStatus(HttpServletResponse.SC_NOT_FOUND);
>
> in cooperation with the mentioned <error-page> directive in web.xml.
>
> Mirek
>
>
> L. Mohan Arun wrote:
>
>>Tomcat 4.1
>>
>>How can I configure Tomcat 4 to return HTTP status code 404 for a "404 Page
>>Not Found" error? Currently it displays a HTML page with "Error type" etc.
>>with status code 200.
>>
>>The docs say <error-page> element in web.xml can be configured to serve
>>another page in response to a 404 error but this is not what I want (because
>>it will return a 200 OK status). I want the actual error code 404 to be
>>returned to the client and HTTP status code 404 (Page not found).
>>
>>Mohan Arun
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
>
--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.10.18/89 - Release Date: 2/Sep/2005
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: HTTP status code 404
Posted by Mirek Stohr <mi...@redash.cz>.
You should use the following procedure
HttpServletResponse.setStatus(HttpServletResponse.SC_NOT_FOUND);
in cooperation with the mentioned <error-page> directive in web.xml.
Mirek
L. Mohan Arun wrote:
> Tomcat 4.1
>
> How can I configure Tomcat 4 to return HTTP status code 404 for a "404 Page
> Not Found" error? Currently it displays a HTML page with "Error type" etc.
> with status code 200.
>
> The docs say <error-page> element in web.xml can be configured to serve
> another page in response to a 404 error but this is not what I want (because
> it will return a 200 OK status). I want the actual error code 404 to be
> returned to the client and HTTP status code 404 (Page not found).
>
> Mohan Arun
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org