Custom error page in tomcat for HTTP 501 error

Question

Before anything else, I've already read all those solutions that says I put an error-page block in my application's or tomcat's conf/web.xml and add an error-code block inside with the corresponding location and those didn't work (did those for 404 errors and those worked).

What I already did inside my application's and tomcat's web.xml:

 
    404
    /pageNotFound.html


 
    501
    /pageNotFound.html

I'm using Tomcat 8.5.63, and the goal is to remove the "Apache Tomcat/8.5.63" part on the response whenever a 501 error appears.

I want to remove this part: tomcat error response page

The way I'm testing this is that I intercept a request using a pentest tool (I'm using burp suite community) and modify a request to include a Transfer-Encoding: cow header (yes I know that header is invalid).

Any ideas on how to implement a custom page so that the 501 can be handled properly?

user_11748454 · Answer

The error pages you declare are used in two situations:

To allow developers to customize the appearance of content returned to a Web client when a servlet generates an error, the deployment descriptor defines a list of error page descriptions. The syntax allows the configuration of resources to be returned by the container either when a servlet or filter calls sendError on the response for specific status codes, or if the servlet generates an exception or error that propagates to the container.

(Servlet 4.0 Specification, section 10.9.2)

In your case the error happens much earlier during the processing of the HTTP request itself. Therefore you need to modify the server's configuration (server.xml) and add a custom ErrorReportValve (cf. documentation). If all you want is to omit the server's version string, just add:

...

Custom error page in tomcat for HTTP 501 error

1 Answers