Disable display of the default error pages for CA Process Automation

Products

• CA Process Automation Base

Issue/Introduction

When requesting a 404 or 500 page from the CA Process Automation server how do we ensure a custom one is displayed, rather than the Tomcat default that present version information?

Environment

Release : 4.3

Component : Process Automation

Resolution

To perform this, you must update PAM\server\c2o\deployers\jbossweb.deployer\web.xml and stop the vulnerable information being displayed by JBOSS. 

Tomcat uses PAM\server\c2o\ext-deploy\c2oear-snapshot.ear\web-snapshot.war\WEB-INF\web.xml for its configuration, and the home folder for the 404.html is PAM\server\c2o\ext-deploy\c2oear-snapshot.ear\web-snapshot.war

JBOSS uses PAM\server\c2o\deployers\jbossweb.deployer\web.xml and home is PAM\server\c2o\deploy\ROOT.war

Each of these contains a section for "error-page" - for the example of 404, you can edit

 <error-page>
  <!-- Missing resource -->
  <error-code>404</error-code>
  <location>/404.html</location>
 </error-page>

However, there is a second element to be aware of for Internet Explorer - the browser decides any error page under 512 bytes is too uninformative, and decides to override it with its own page instead. If you're creating a custom error, consider making the file larger than this minimum to avoid that happening. This can even be performed by padding it with metadata rather than anything that displays.