隐藏JSF应用中的HTTP Header信息

 

对于JSF的应用，你可能会在HTTP的头信息中看到这样的字样：

Server : Apache/2.0.61 (Unix)
X-Powered-By : JSF/1.2

让用户知道这些消息没有太大意义，而且可能造成安全漏洞。需要屏蔽的话可以参考以下步骤：

隐藏Server信息：在apache里控制的,在httpd.conf里加入一行

    ServerTokens Prod

隐藏X-Powered-By：在web.xml中加入：

 

view plain copy to clipboard print ?

1. <context-param>  
2.     <param-name>com.sun.faces.sendPoweredByHeader</param-name>  
3.     <param-value>false</param-value>  
4. </context-param>  

<context-param> <param-name>com.sun.faces.sendPoweredByHeader</param-name> <param-value>false</param-value> </context-param>

 

对于JBoss，需要找到这个文件：<JBOSS_HOME>/server/default/deploy/jboss-web.deployer/conf/web.xml，然后加入以下代码：

 

view plain copy to clipboard print ?

1. <filter>  
2.       <filter-name>CommonHeadersFilter</filter-name>  
3.       <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class>  
4.       <init-param>  
5.          <param-name>X-Powered-By</param-name>  
6.          <param-value>Servlet 2.4; JBoss-4.2.0.GA (build:   
7. SVNTag=JBPAPP_4_2_0_GA date=200706281411)/Tomcat-5.5</param-value>  
8.       </init-param>  
9.    </filter>  
10. ↓   
11.    <filter>  
12.       <filter-name>CommonHeadersFilter</filter-name>  
13.       <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class>  
14.    </filter>  

<filter> <filter-name>CommonHeadersFilter</filter-name> <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class> <init-param> <param-name>X-Powered-By</param-name> <param-value>Servlet 2.4; JBoss-4.2.0.GA (build: SVNTag=JBPAPP_4_2_0_GA date=200706281411)/Tomcat-5.5</param-value> </init-param> </filter> ↓ <filter> <filter-name>CommonHeadersFilter</filter-name> <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class> </filter>

 

 

 

转载自 http://www.ondev.net/post/show/585