root
/
spring-boot
mirror of https://github.com/spring-projects/spring-boot.git
1
0
Fork 0
Code Issues Actions 19 Packages Projects Releases Wiki Activity

Disable Server header by default when using SSL with Jetty 9 

Closes gh-7359
This commit is contained in:
Andy Wilkinson 2016-11-11 11:46:57 +00:00
parent 72e696bcbd
commit a1dda12bcb
2 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
spring-boot/src/main/java/org/springframework/boot/context/embedded/jetty/JettyEmbeddedServletContainerFactory.java
View File

@ -692,6 +692,7 @@ public class JettyEmbeddedServletContainerFactory
public ServerConnector getConnector(Server server,
SslContextFactory sslContextFactory, int port) {
HttpConfiguration config = new HttpConfiguration();
config.setSendServerVersion(false);
config.addCustomizer(new SecureRequestCustomizer());
HttpConnectionFactory connectionFactory = new HttpConnectionFactory(config);
SslConnectionFactory sslConnectionFactory = new SslConnectionFactory(

35
spring-boot/src/test/java/org/springframework/boot/context/embedded/AbstractEmbeddedServletContainerFactoryTests.java
View File

@ -420,6 +420,41 @@ public abstract class AbstractEmbeddedServletContainerFactoryTests {
.contains("scheme=https");
}
@Test
public void serverHeaderIsDisabledByDefaultWhenUsingSsl() throws Exception {
AbstractEmbeddedServletContainerFactory factory = getFactory();
factory.setSsl(getSsl(null, "password", "src/test/resources/test.jks"));
this.container = factory.getEmbeddedServletContainer(
new ServletRegistrationBean(new ExampleServlet(true, false), "/hello"));
this.container.start();
SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(
new SSLContextBuilder()
.loadTrustMaterial(null, new TrustSelfSignedStrategy()).build());
HttpClient httpClient = HttpClients.custom().setSSLSocketFactory(socketFactory)
.build();
ClientHttpResponse response = getClientResponse(getLocalUrl("https", "/hello"),
HttpMethod.GET, new HttpComponentsClientHttpRequestFactory(httpClient));
assertThat(response.getHeaders().get("Server")).isNullOrEmpty();
}
@Test
public void serverHeaderCanBeCustomizedWhenUsingSsl() throws Exception {
AbstractEmbeddedServletContainerFactory factory = getFactory();
factory.setServerHeader("MyServer");
factory.setSsl(getSsl(null, "password", "src/test/resources/test.jks"));
this.container = factory.getEmbeddedServletContainer(
new ServletRegistrationBean(new ExampleServlet(true, false), "/hello"));
this.container.start();
SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(
new SSLContextBuilder()
.loadTrustMaterial(null, new TrustSelfSignedStrategy()).build());
HttpClient httpClient = HttpClients.custom().setSSLSocketFactory(socketFactory)
.build();
ClientHttpResponse response = getClientResponse(getLocalUrl("https", "/hello"),
HttpMethod.GET, new HttpComponentsClientHttpRequestFactory(httpClient));
assertThat(response.getHeaders().get("Server")).containsExactly("MyServer");
}
protected final void testBasicSslWithKeyStore(String keyStore) throws Exception {
AbstractEmbeddedServletContainerFactory factory = getFactory();
addTestTxtFile(factory);