title: How to hide server name in response in case of TRACE http Method in spring MVC
body: <p>I am working on fixing Penetration testing items. As per reported issue, server name display in response when tester penetrate our web application request and change "TRACE"/OPTIONS/PUT/DELETE/HEAD from "GET" and we get below response.</p>
  
  <pre><code>    Request Header - 
  
      TRACE /MyWebApp/ApplicationDetails HTTP/1.1
  
      Host: 10.253.435.736:8080
  
      User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 
      Firefox/50.0
  
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  
      Accept-Language: en-US,en;q=0.5
  
      Accept-Encoding: gzip, deflate
  
      Cookie: JSESSIONID=0103C35D187B18V53A0E9B7C3D0F36E6
  
      Connection: close
      Upgrade-Insecure-Requests: 1
  
      Response Header - 
      HTTP/1.1 405 Method Not Allowed
      Server: Apache-Coyote/1.1
      Allow: POST, GET, DELETE, OPTIONS, PUT, HEAD
      Content-Length: 0
      Date: Tue, 22 Nov 2016 18:07:42 GMT
      Connection: close
  </code></pre>
  
  <p>To restrict PUT, DELETE, OPTIONS, TRACE , HEAD method I have written below code in web.xml</p>
  
  <pre><code>    &lt;security-constraint&gt;
         &lt;web-resource-collection&gt;
           &lt;web-resource-name&gt;restricted methods&lt;/web-resource-name&gt;
           &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
           &lt;http-method&gt;PUT&lt;/http-method&gt;
           &lt;http-method&gt;PATCH&lt;/http-method&gt;
           &lt;http-method&gt;HEAD&lt;/http-method&gt;
           &lt;http-method&gt;DELETE&lt;/http-method&gt;
           &lt;http-method&gt;OPTIONS&lt;/http-method&gt;
           &lt;http-method&gt;TRACE&lt;/http-method&gt;
         &lt;/web-resource-collection&gt;
         &lt;auth-constraint/&gt;
      &lt;/security-constraint&gt;
  </code></pre>
  
  <p>I have created a Servlet exception handler class as follows to handle servlet exception</p>
  
  <pre><code>    @WebServlet("/AppExceptionHandler")
      public class AppExceptionHandler extends HttpServlet {
          private static final long serialVersionUID = 1L;
  
          /**
           * @see HttpServlet#HttpServlet()
           */
          public AppExceptionHandler() {
              super();
              // TODO Auto-generated constructor stub
          }
  
          public void doPost(HttpServletRequest request,
                  HttpServletResponse response)
              throws ServletException, IOException {
              processError(request, response);
              }
  
          public void doGet(HttpServletRequest request,
                  HttpServletResponse response)
              throws ServletException, IOException {
              processError(request, response);
              }
  
          public void doTrace(HttpServletRequest request,
                  HttpServletResponse response) throws ServletException, IOException {
              processError(request, response);
          }
          public void service(HttpServletRequest request,
                  HttpServletResponse response) throws ServletException, IOException {
              processError(request, response);
          }
          private void processError(HttpServletRequest request,
                  HttpServletResponse response) throws IOException {
              // Analyze the servlet exception
              if (response != null) {
                  response.addHeader("Server", StringUtils.EMPTY);
              }
              Throwable throwable = (Throwable) request
                      .getAttribute("javax.servlet.error.exception");
              Integer statusCode = (Integer) request
                      .getAttribute("javax.servlet.error.status_code");
              String servletName = (String) request
                      .getAttribute("javax.servlet.error.servlet_name");
              if (servletName == null) {
                  servletName = "Unknown";
              }
              String requestUri = (String) request
                      .getAttribute("javax.servlet.error.request_uri");
              if (requestUri == null) {
                  requestUri = "Unknown";
              }
              String pageName="error";
              // Set response content type
                response.setContentType("text/html");
  
                if(statusCode == 403 || statusCode == 405){
                    response.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED); 
                }
                else if(statusCode == 404){
                    pageName="404";
                }
  
                try {
                  request.getRequestDispatcher("/view/" + pageName + ".jsp").forward(request, response);
              } catch (ServletException e) {
                  // TODO Auto-generated catch block
                  e.printStackTrace();
              }
          }
  </code></pre>
  
  <p>I have mapped above class with below setting in web.xml </p>
  
  <pre><code>    &lt;error-page&gt;
          &lt;error-code&gt;404&lt;/error-code&gt;
          &lt;location&gt;/AppExceptionHandler&lt;/location&gt;
        &lt;/error-page&gt;
        &lt;error-page&gt;
          &lt;error-code&gt;403&lt;/error-code&gt;
          &lt;location&gt;/AppExceptionHandler&lt;/location&gt;
        &lt;/error-page&gt;
        &lt;error-page&gt;
          &lt;error-code&gt;405&lt;/error-code&gt;
          &lt;location&gt;/AppExceptionHandler&lt;/location&gt;
        &lt;/error-page&gt;
          &lt;error-page&gt;
              &lt;exception-type&gt;javax.servlet.ServletException&lt;/exception-type&gt;
              &lt;location&gt;/AppExceptionHandler&lt;/location&gt;
        &lt;/error-page&gt;
        &lt;error-page&gt;
        &lt;exception-type&gt;java.lang.Throwable&lt;/exception-type&gt;
        &lt;location&gt;/AppExceptionHandler&lt;/location&gt;
      &lt;/error-page&gt;
      &lt;error-page&gt;
        &lt;exception-type&gt;java.io.IOException&lt;/exception-type&gt;
        &lt;location&gt;/AppExceptionHandler&lt;/location&gt;
      &lt;/error-page&gt;
  </code></pre>
  
  <p>After implementing above code and web.xml config entry, our application does not display server name for OPTIONS/HEAD/PUT/DELETE http method while it display for TRACE http method. When we replace GET with TRACE it neither hit our servlet exception handler class "AppExceptionHandler" nor any Filter class and it display server name as shown above.</p>
  
  <p>In short, above fix is working in all case except TRACE http method.</p>
  
  <p>I don't understand what should I do to fix this issue.</p>
  
  <p>As this is my first post in this forum so please guide me in case I missed any information.</p>