tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From August Kleimo <>
Subject “exception-message” header reveals path to document root in 404 response.
Date Fri, 10 Jan 2014 23:28:00 GMT
I'm failing a PCI compliance scan because my Tomcat Version 7.0.20 server
is revealing the path to the document web root in an "exception-message"
header when a missing page is requested.

Does anyone know of way to get rid of this header from the response?

Note: I'm running Railo 4.1.2 on top of Tomcat ... but I think this header
is coming from Tomcat.

$ curl -I

HTTP/1.1 404 Not Found
Date: Fri, 10 Jan 2014 23:23:22 GMT
Server: Apache-Coyote/1.1
exception-message: Page
/this-page-does-not-exist.html [/var/www/html/this-page-does-not-exist.html]
not found
Content-Type: text/html;charset=UTF-8
Content-Length: 44
Set-Cookie: cfid=686ea13b-ef35-43c3-b6e4-08270bbb4718;Path=/;Expires=Sun,
10-Jan-2044 07:14:52 GMT;HTTPOnly
Set-Cookie: cftoken=0;Path=/;Expires=Sun, 10-Jan-2044 07:14:52 GMT;HTTPOnly
Connection: close

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message