Server header

This should be optional.

ctx.header(Header.SERVER, "Javalin")

https://github.com/tipsy/javalin/blob/master/javalin/src/main/java/io/javalin/http/JavalinServlet.kt#L76

[tipsy]

Thanks @mekiert !

In Javalin 4, which is coming out soon, the Server header is disabled by default 😃

[mekiert]

There is a way to remove it. I show my solution using Kotlin.

Remove ‘Server’ header from Javalin To remove a ‘Server’ header from Javalin we can set its value to null, just after handling the request.

after { it.res.setHeader("Server", null) }

Now instead of ‘Server = Javalin’ you should see a header ‘Server = Jetty(xxxx)’.

Remove ‘Server’ header from Jetty As the ‘Server’ header from Javalin was only a cover for header from Jetty, you should remove the ‘Server’ header from Jetty as well.

This code does the job:

Javalin.create { config ->
  config.server {
    Server().apply {
      val httpConfig = HttpConfiguration()
      // Hide 'Server' header as it reveals the used library
      httpConfig.sendServerVersion = false
      val httpFactory = HttpConnectionFactory(httpConfig)
      val httpConnector = ServerConnector(server, httpFactory)
      // Change the value to your actuall port
      httpConnector.port = 7000
      connectors = arrayOf(httpConnector) 
    } 
  }
}

Based on: https://stackoverflow.com/a/23245256

Explanation:

1. You should create your own Jetty Server using server method from JavalinConfig
2. Set sendServerVersion in HttpConfiguration to false
3. Remember to set the port, because you create a new ServerConnector

That’s it! You are free from the ‘Server’ header now! 😎

Message to maintainer/s 🛠 In my opinion, the Javalin ‘Server’ header should be set only if it was previously set by Jetty. It is pointless to set this header to ‘Javalin’ and then to remove it.

Btw, thanks for your great job with Javalin 👍