Remove HTTP Response headers in Java

Question

Is there a way to remove HTTP response headers like Server and X-Powered-By?

My application is using a Weblogic server. I'm programming in Java using the Spring MVC framework and Hibernate, and using JSP for views.

Clisthenes

What comes to my mind is write a Filter to deal with this – Richella

Answer 1

Depends on where the headers are added. If inside your app, you can use a Spring MVC Interceptor to remove them after your controller calls. If outside your app, you might be able to try a Java EE filter configured in web.xml (the example is security, but the approach will also work for your use case). If its added after that, you may want to look at your web front end (Apache, IIS, what-have-you) to configure a filter there.

UPDATE

This answer describes an approach for removing specific headers, as the HttpServletResponse interface does not allow for header removal explicitly. You will need some trial and error to determine what portion of your stack is adding the header.

Dormer

headers I mentioned are not added explicitly. They are showing up in the response. Need to explicitly block them from showing to user for security purposes – Clisthenes

I updated. Regardless of whether it is added explicitly, you will need to determine where it's being set as a side effect. – Dormer

please help me on #20421829 – Matrimonial

Answer 2

If you set concrete responseHeader to null it will be removed / not seen in response headers.

Sociality