隐藏JSF应用中的HTTP Header信息

对于JSF的应用，你可能会在HTTP的头信息中看到这样的字样：

Server : Apache/2.0.61 (Unix)

X-Powered-By : JSF/1.2

让用户知道这些消息没有太大意义，而且可能造成安全漏洞。需要屏蔽的话可以参考以下步骤：

隐藏Server信息
：在apache里控制的,在httpd.conf里加入一行

ServerTokens Prod

隐藏X-Powered-By
：在web.xml中加入：



<
context-param
>

<
param-name
>
com.sun.faces.sendPoweredByHeader
</
param-name
>

<
param-value
>
false
</
param-value
>

</
context-param
>

<context-param>
<param-name>com.sun.faces.sendPoweredByHeader</param-name>
<param-value>false</param-value>
</context-param>

对于JBoss，需要找到这个文件：<JBOSS_HOME>/server/default/deploy/jboss-web.deployer/conf/web.xml，然后加入以下代码：



<
filter
>

<
filter-name
>
CommonHeadersFilter
</
filter-name
>

<
filter-class
>
org.jboss.web.tomcat.filters.ReplyHeaderFilter
</
filter-class
>

<
init-param
>

<
param-name
>
X-Powered-By
</
param-name
>

<
param-value
>
Servlet 2.4; JBoss-4.2.0.GA (build:

SVNTag
=
JBPAPP_4_2_0_GA

date
=
200706281411
)/Tomcat-5.5
</
param-value
>

</
init-param
>

</
filter
>

↓

<
filter
>

<
filter-name
>
CommonHeadersFilter
</
filter-name
>

<
filter-class
>
org.jboss.web.tomcat.filters.ReplyHeaderFilter
</
filter-class
>

</
filter
>

<filter>
<filter-name>CommonHeadersFilter</filter-name>
<filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class>
<init-param>
<param-name>X-Powered-By</param-name>
<param-value>Servlet 2.4; JBoss-4.2.0.GA (build:
SVNTag=JBPAPP_4_2_0_GA date=200706281411)/Tomcat-5.5</param-value>
</init-param>
</filter>
↓
<filter>
<filter-name>CommonHeadersFilter</filter-name>
<filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class>
</filter>