隱藏JSF應用中的HTTP Header資訊

 

對於JSF的應用，你可能會在HTTP的頭資訊中看到這樣的字樣：

Server : Apache/2.0.61 (Unix)
X-Powered-By : JSF/1.2

讓使用者知道這些訊息沒有太大意義，而且可能造成安全性漏洞。需要屏蔽的話可以參考以下步驟：

隱藏Server資訊：在apache裡控制的,在httpd.conf裡加入一行

    ServerTokens Prod

隱藏X-Powered-By：在web.xml中加入：

 

{
function onclick()
{
dp.sh.Toolbar.Command('ViewSource',this);return false;
}
}" href="http://www.ondev.net/post/show/585">view plain{
function onclick()
{
dp.sh.Toolbar.Command('CopyToClipboard',this);return false;
}
}" href="http://www.ondev.net/post/show/585">copy to clipboard{
function onclick()
{
dp.sh.Toolbar.Command('PrintSource',this);return false;
}
}" href="http://www.ondev.net/post/show/585">print{
function onclick()
{
dp.sh.Toolbar.Command('About',this);return false;
}
}" href="http://www.ondev.net/post/show/585">?

1. <context-param>  
2.     <param-name>com.sun.faces.sendPoweredByHeader</param-name>  
3.     <param-value>false</param-value>  
4. </context-param>  

<context-param><br /> <param-name>com.sun.faces.sendPoweredByHeader</param-name><br /> <param-value>false</param-value><br /></context-param>

 

對於JBoss，需要找到這個檔案：<JBOSS_HOME>/server/default/deploy/jboss-web.deployer/conf/web.xml，然後加入以下代碼：

 

{
function onclick()
{
dp.sh.Toolbar.Command('ViewSource',this);return false;
}
}" href="http://www.ondev.net/post/show/585">view plain{
function onclick()
{
dp.sh.Toolbar.Command('CopyToClipboard',this);return false;
}
}" href="http://www.ondev.net/post/show/585">copy to clipboard{
function onclick()
{
dp.sh.Toolbar.Command('PrintSource',this);return false;
}
}" href="http://www.ondev.net/post/show/585">print{
function onclick()
{
dp.sh.Toolbar.Command('About',this);return false;
}
}" href="http://www.ondev.net/post/show/585">?

1. <filter>  
2.       <filter-name>CommonHeadersFilter</filter-name>  
3.       <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class>  
4.       <init-param>  
5.          <param-name>X-Powered-By</param-name>  
6.          <param-value>Servlet 2.4; JBoss-4.2.0.GA (build:   
7. SVNTag=JBPAPP_4_2_0_GA date=200706281411)/Tomcat-5.5</param-value>  
8.       </init-param>  
9.    </filter>  
10. ↓   
11.    <filter>  
12.       <filter-name>CommonHeadersFilter</filter-name>  
13.       <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class>  
14.    </filter>  

<filter><br /> <filter-name>CommonHeadersFilter</filter-name><br /> <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class><br /> <init-param><br /> <param-name>X-Powered-By</param-name><br /> <param-value>Servlet 2.4; JBoss-4.2.0.GA (build:<br />SVNTag=JBPAPP_4_2_0_GA date=200706281411)/Tomcat-5.5</param-value><br /> </init-param><br /> </filter><br />↓<br /> <filter><br /> <filter-name>CommonHeadersFilter</filter-name><br /> <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class><br /> </filter><br />

 

 

 

轉載自 http://www.ondev.net/post/show/585