Win a copy of Java Challengers this week in the Java in General forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Paul Clapham
  • Ron McLeod
  • paul wheaton
  • Devaka Cooray
Sheriffs:
  • Jeanne Boyarsky
  • Tim Cooke
  • Liutauras Vilda
Saloon Keepers:
  • Tim Moores
  • Tim Holloway
  • Stephan van Hulst
  • Carey Brown
  • Piet Souris
Bartenders:
  • salvin francis
  • Mikalai Zaikin
  • Himai Minh

Custom error page for HTTP 501 errors in tomcat

 
Greenhorn
Posts: 3
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
What I already did inside my application's and tomcat's web.xml:



I'm using Tomcat 8.5.63, and the goal is to remove the "Apache Tomcat/8.5.63" part on the default server response page whenever a 501 error appears.
The way I'm testing this is that I intercept a request using a pentest tool (I'm using burp suite community)
and modify a request to include a header (yes I know that header is invalid).

Any ideas on how to implement a custom page so that the 501 can be handled properly?
 
Saloon Keeper
Posts: 23540
161
Android Eclipse IDE Tomcat Server Redhat Java Linux
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I actually had to look at Tomcat source code about this, since I had some suspicions, and I think my suspicions are correct.

In certain cases, Tomcat itself generates and returns HTTP response code 501. I don't have a full list, but it looks like certain overload situations can trigger it, but also sending a request type other than the official "GET", "POST", "HEAD", "OPTIONS", ... will return a 501 (which is literally "request not implemented").

In such cases, you cannot modify the error page, because there is no error page. Tomcat sends back a response without a body and the actual "web page" displayed is generated by the client and thus depends on the client.

If having Tomcat yak out server details that you don't wish to be known is a problem, that wouldn't be unique to 501 responses, though. That sort of info comes back with every Tomcat response so you'd have to filter the header generation process.
 
With a little knowledge, a cast iron skillet is non-stick and lasts a lifetime.
reply
    Bookmark Topic Watch Topic
  • New Topic