Search code examples
securityserverembedded-server

How to hide Tomcat version from error messages when using embedded servers in Java

I have a java application where i'm using embedded Tomcat servers, which looks like this

Tomcat tomcat = new Tomcat()

I'm creating an embedded tomcat server here.

Problem statement

whenever there's an error it displays information on which tomcat version i'm using, enter image description here

how to hide this in java?

i have a little idea that i need to override ServerInfo.properties, but how do i do this?

Solution

  • I'm not sure how we can do this in java, but if you are using any build scripts like ant / gradle for distribution purpose, we can write a task to override / harden the jar file, and replace the ServerInfo.properties file with the customized value whatever we need.

    the code for ant build scripts would look like

    <target name="override.tomcat">
        <jar destfile="path/to/tomcat-embed-core-9.0.62.jar" update="true">
            <fileset dir="src/"> <!-- folder where you keep the directory/file to raplace-->
                <include name="org/apache/catalina/util/ServerInfo.properties"/> <!-- file to replace within directory path in side the jar-->
            </fileset>
        </jar>
    </target>

    and in gradle

    task overRideTomcat(type: Jar) {
    from(zipTree(file("path/to/tomcat-embed-core-9.0.62.jar"))) {
        exclude '**/org/apache/catalina/util/ServerInfo.properties'
    }

    from('src/') {
        include('/org/apache/catalina/util/ServerInfo.properties')
    }

    archiveName "tomcat-embed-core-9.0.62.jar"
}

    make sure you have the modified ServerInfo.properties file under src directory in the same path as you have mentioned in the include statement.