title: Reducing information disclosure in Tomcat error pages
body: <p>By default, Tomcat's error pages disclose both the existence of Tomcat and the exact version of the container that's handling the requests.  This is nice for development, but in a production context this information is a potential security hole and it would be nice to disable it.</p>
  
  <p>Thus I would like to know what the best (as in most straightforward/comprehensive) solution is to completely suppress Tomcat's default error pages.  I am aware of the <code>&lt;error-page&gt;</code> option in web.xml, but it seems to fail on both desired counts, partly because I would have to list the same alternative error page many times (one for each response code I want to handle), and because this strikes me as possibly not 100% robust; if an attacker can somehow get an error code returned that I haven't explicitly listed, they would get the default error page.</p>
  
  <p>Ideally, a simple option to set a universal custom error page, or to flat out disable sending any HTML along with the error code in the default error page, would be best.  If neither of those options are possible, I'd be interested in finding out what the typical way to implement this functionality is (bonus points for discussing/showing why those hypothetical options don't exist, since it seems my requirement would be quite standard for anyone using Tomcat in production...).</p>