users@glassfish.java.net

RE: Obfuscation: How to disable optional http header fields in glassfish 3.0.1

From: Koper, Dies <diesk_at_fast.au.fujitsu.com>
Date: Wed, 8 Sep 2010 15:01:37 +1000

Hi nabizamani,

> [b]-"X-Powered-By: Servlet/3.0" and "X-Powered-By: JSP/2.1"[/b]
>
> Here are the Steps I tried to disable this header field:
>
> 1. go to https://www.mydomain.com:4848/common/index.jsf
> 2. choose "Configuration"
> 3. Choose "Network Config"
> 4. Choose "Network Listeners"
> 5. Choose i.e. "http-listener-2"
> 6. Choose tab "HTTP"
> 7. Uncheck the checkbox "XPowered By:" and safe afterwards + restart
> server
> (just to make sure...)
>
> This is not working!

Port 4848 is used by the "admin-listener". If you remove the tick here
you should check responses to this port, not port 80.
Alternatively, try removing the tick on "http-listener" and call
http://www.mydomain.com.

Regards,
Dies