Search code examples
javaspringspring-boottomcat

How to mask Apache Version on Error Page of Spring Boot application?

I have a spring boot application with embedded tomcat , whenever there is a server error occurs, I want to hide the apache tomcat version on error page.

As far as I know; the most known solutions are adding server.properties to web.xml or zipping the catalina jar.

Since the application does not have web.xml, I can't figure it out to hide tomcat version.

Tomcat server properties were changed as below but none of them worked.

  • server.error.include-stacktrace=never

  • server.error.whitelabel.enabled=false

Spring boot version : 2.5.4

Please refer the picture.

Thanks!

enter image description here

Solution

  • For embedded tomcat, I found configuration to override error report valve

    Now the response does not have tomcat version.

    
var host = (StandardHost) tomcat.getHost();

var errorReportValve = new org.apache.catalina.valves.ErrorReportValve();
errorReportValve.setShowReport(false);
errorReportValve.setShowServerInfo(false);
host.addValve(errorReportValve);