How to remove (duplicate) X-Powered-By: JSF/2.0

Question

In my instance, I have Glassfish 3.1.1 / Mojarra 2.1.3

I could remove the X-Powered-By in Glassfish Admin Console in the Network listener (so it doesn't show the long text:

Servlet/3.0 JSP/2.2 (GlassFish Server Open Source Edition 3.1.1 Java/Sun Microsystems Inc./1.6)

but it still shows (yes, twice):

X-Powered-By: JSF/2.0
X-Powered-By: JSF/2.0

I am using Jersey and JAXB to expose some web-services and have some servlets deployed using the @WebServlet Annotation but I don't think they add anything.

It is not generated by mod_jk or Apache because I get those headers even when connecting to the application port directly (localhost:8080)

Is there typical modules that would do that in Glassfish? How can I remove these headers?

Thank you

Answer 1

It's been set by Mojarra. You can disable it by setting the context parameter com.sun.faces.sendPoweredByHeader to false in webapp's web.xml.

<context-param>
    <param-name>com.sun.faces.sendPoweredByHeader</param-name>
    <param-value>false</param-value>
</context-param>

However, that it sends the value twice is a mystery to me. This is not the default behaviour and technically impossible (as it would indicate the ExternalContextImpl being constructed twice on the same response). Perhaps mod_jk is doing something wrong.