You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Chad Cannell <cc...@elogex.com> on 2002/11/06 17:11:13 UTC

Suppress Servlet-Engine Info in HTTP Header

I am trying to tighten up our Apache and Tomcat implementation. I want
to suppress server type and version to make fingerprinting harder. We
have Apache httpd in front of Tomacat on Win32. I can suppress the
Apache info passed in "Server:" parameter, but do not know how to
suppress the "Servlet-Engine:" that Tomcat passes.  Anyone?

HTTP response header

HTTP/1.1 200 OK
Date: Tue, 05 Nov 2002 17:49:51 GMT
Server: 
Set-Cookie2: JSESSIONID=naa2in3fj1;Version=1;Discard;Path="/"
Set-Cookie: JSESSIONID=naa2in3fj1;Path=/
Servlet-Engine: Tomcat Web Server/3.2.3 (JSP 1.1; Servlet 2.2; Java
1.3.1_04; Windows 2000 5.0 x86; java.vendor=Sun Microsystems Inc.)
<---Want to null this  
Connection: close

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: Suppress Servlet-Engine Info in HTTP Header

Posted by Tim Funk <fu...@joedog.org>.
See mod_headers: http://httpd.apache.org/docs/mod/mod_headers.html

In particular, you probably want this:
##################################
Header unset Servlet-Engine
##################################

-Tim


Chad Cannell wrote:
> I am trying to tighten up our Apache and Tomcat implementation. I want
> to suppress server type and version to make fingerprinting harder. We
> have Apache httpd in front of Tomacat on Win32. I can suppress the
> Apache info passed in "Server:" parameter, but do not know how to
> suppress the "Servlet-Engine:" that Tomcat passes.  Anyone?
> 
> HTTP response header
> 
> HTTP/1.1 200 OK
> Date: Tue, 05 Nov 2002 17:49:51 GMT
> Server: 
> Set-Cookie2: JSESSIONID=naa2in3fj1;Version=1;Discard;Path="/"
> Set-Cookie: JSESSIONID=naa2in3fj1;Path=/
> Servlet-Engine: Tomcat Web Server/3.2.3 (JSP 1.1; Servlet 2.2; Java
> 1.3.1_04; Windows 2000 5.0 x86; java.vendor=Sun Microsystems Inc.)
> <---Want to null this  
> Connection: close
> 


--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>