Thursday, May 29, 2014

Show or Hide Liferay Portal name and version details in HTTP response headers

The default behavior for Liferay Portal is to return the name and version details in HTTP response headers.




This poses a potential security risk as Liferay Portal is advertising itself to the world.

This is not ideal for public facing web web sites which are open to attack by third-parties.

This article outlines the configuration support in Liferay Portal 6.1.2 Enterprise Edition (EE) for adjusting the Liferay Portal name and version details returned in HTTP response headers.

Configuration

Liferay Portal Properties

Edit file "LIFERAY_HOME/portal-ext.properties".
Add the following snippet.
Adjust property "http.header.version.verbosity" to suit your web site requirements.

http.header.version.verbosity=partial
or
http.header.version.verbosity=Liferay Portal Enterprise Edition