tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Remy Maucherat <>
Subject Re: cvs commit: jakarta-tomcat-jasper/jasper2/src/share/org/apache/jasper/servlet
Date Tue, 22 Jul 2003 08:24:42 GMT
Jan Luehe wrote:
>> This is a pretty bad implementation IMO.
>> What's the use of disabling this feature ?
> The spec declares these headers as optional, which means Tomcat should 
> make them configurable. Some sites may prefer not to include this 
> information in their responses, for security reasons or whatever.

IIS 6 has similar headers, and I believe do not have any option to hide 
them. This has no bandwidth savings or anything. It is not worth adding 
flags everywhere for that.
If you really want to add a flag, add it on the connector, and set the 
header in the CoyoteAdapter. As for the JSP flag, it should be a Jasper 
option if you really want to have it optional, not based on a bad test 
(why does the presence of a X-Powered header indicate anything ?).
BTW, I don't see why the spec saying that the header is optional implies 
that the flag must be implemented as something optional. It merely means 
that an implementation may ignore completely this feature.
I maintain my -1 (sorry for disliking your patches these days): adding 
configurability, down to flag addition in the core interfaces, to such a 
trivial feature is ridiculous (or we should have 300 flags in the 
Context interface, which we obviously don't want). Please revert your patch.

>> -1 on the various flags and checks (just add the headers, without 
>> flags and complexity). -0 if you can indicate a good reason for this.
>> Also, you shouldn't add the JSP 2.0 header in JspServlet. If you 
>> precompile, it's not called. Put it in HttpJspBase.
> I had thought about adding the JSP 2.0 header in HttpJspBase, but then 
> realized that the "extends" page directive allows you to specify the 
> class that the generated servlet should extend, in which case 
> HttpJspBase will be out of the picture. Do you have a better idea?

I forgot about that feature, but HttpJspBase seems less often out of the 
picture than JspServlet. Did you try to get a stack trace from a 
precompiled JSP (which will become the norm in 5.0.x) ? Or assume that a 
compiled JSP is no longer a JSP, and then leave it in JspServlet.


To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message