Issue
Application Server Version being disclosed in the HttpRequest Headers.
Environment
- Liferay DXP 7.0
Resolution
This type of issue relates to application server configuration instead of Liferay implementation.
There is a fact, that 7.0 uses Tomcat 8.x while later versions of Liferay use Tomcat 9.x. Tomcat 8 shows the header Server by default, and Tomcat 9 does not.
For Tomcat, you can override server header as mentioned here:
https://tomcat.apache.org/tomcat-8.0-doc/config/http.html
For JBoss, the solution mentioned by the Redhat which might be helpful:
https://access.redhat.com/solutions/2740891
Additional Information
- This resolution requires customization and should only be implemented at the discretion of your team. Liferay Support will not be able to assist with designing or implementing customizations.