From 430b92d388fc5c582ad7104a5e09756c3fbcbd92 Mon Sep 17 00:00:00 2001
From: Javier <jfuentes@hortonworks.com>
Date: Fri, 31 Jan 2020 16:02:17 -0300
Subject: [PATCH 1/2] added parameter and doc

---
 conf/zeppelin-site.xml.template                     |  8 ++++++++
 docs/setup/security/http_security_headers.md        | 13 ++++++++++++-
 .../apache/zeppelin/conf/ZeppelinConfiguration.java |  5 +++++
 .../org/apache/zeppelin/server/ZeppelinServer.java  |  2 +-
 4 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/conf/zeppelin-site.xml.template b/conf/zeppelin-site.xml.template
index 225498edfd9..a06c88ffa35 100755
--- a/conf/zeppelin-site.xml.template
+++ b/conf/zeppelin-site.xml.template
@@ -485,6 +485,14 @@
 </property>
 -->
 
+<!--
+<property>
+    <name>zeppelin.server.send.jetty.name</name>
+    <value>true</value>
+    <description>If set to true, will not show the Jetty version to prevent Fingerprinting</description>
+</property>
+-->
+
 <!--
 <property>
     <name>zeppelin.server.jetty.request.header.size</name>
diff --git a/docs/setup/security/http_security_headers.md b/docs/setup/security/http_security_headers.md
index 9fcb9f4755a..91f083eb8b9 100644
--- a/docs/setup/security/http_security_headers.md
+++ b/docs/setup/security/http_security_headers.md
@@ -121,4 +121,15 @@ The following property needs to be updated in the zeppelin-site.xml in order to
 </property>
 ```
 
-The value can be any "String".
\ No newline at end of file
+The value can be any "String".
+
+Also, it can be removed the from response headers and from 300/400/500 HTTP response pages.
+
+
+```xml
+<property>
+    <name>zeppelin.server.send.jetty.name</name>
+    <value>false</value>
+    <description>If set to true, will not show the Jetty version to prevent Fingerprinting</description>
+</property>
+```
\ No newline at end of file
diff --git a/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java b/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
index a6123ec661b..25d07739cb2 100644
--- a/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
+++ b/zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
@@ -618,6 +618,10 @@ public String getJettyName() {
     return getString(ConfVars.ZEPPELIN_SERVER_JETTY_NAME);
   }
 
+  public boolean sendJettyName() {
+    return getBoolean(ConfVars.ZEPPELIN_SERVER_SEND_JETTY_NAME);
+  }
+
   public Integer getJettyRequestHeaderSize() {
     return getInt(ConfVars.ZEPPELIN_SERVER_JETTY_REQUEST_HEADER_SIZE);
   }
@@ -887,6 +891,7 @@ public enum ConfVars {
     ZEPPELIN_SERVER_DEFAULT_DIR_ALLOWED("zeppelin.server.default.dir.allowed", false),
     ZEPPELIN_SERVER_XFRAME_OPTIONS("zeppelin.server.xframe.options", "SAMEORIGIN"),
     ZEPPELIN_SERVER_JETTY_NAME("zeppelin.server.jetty.name", null),
+    ZEPPELIN_SERVER_SEND_JETTY_NAME("zeppelin.server.send.jetty.name", true),
     ZEPPELIN_SERVER_JETTY_THREAD_POOL_MAX("zeppelin.server.jetty.thread.pool.max", 400),
     ZEPPELIN_SERVER_JETTY_THREAD_POOL_MIN("zeppelin.server.jetty.thread.pool.min", 8),
     ZEPPELIN_SERVER_JETTY_THREAD_POOL_TIMEOUT("zeppelin.server.jetty.thread.pool.timeout", 30),
diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java b/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java
index 966f5b553aa..687056f3904 100644
--- a/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java
+++ b/zeppelin-server/src/main/java/org/apache/zeppelin/server/ZeppelinServer.java
@@ -297,13 +297,13 @@ private static void initServerConnector(Server server, int port, int sslPort) {
     ServerConnector connector;
     HttpConfiguration httpConfig = new HttpConfiguration();
     httpConfig.addCustomizer(new ForwardedRequestCustomizer());
+    httpConfig.setSendServerVersion(conf.sendJettyName());
     if (conf.useSsl()) {
       LOG.debug("Enabling SSL for Zeppelin Server on port " + sslPort);
       httpConfig.setSecureScheme("https");
       httpConfig.setSecurePort(sslPort);
       httpConfig.setOutputBufferSize(32768);
       httpConfig.setResponseHeaderSize(8192);
-      httpConfig.setSendServerVersion(true);
 
       HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
       SecureRequestCustomizer src = new SecureRequestCustomizer();

From 44e04749589a6916c8969d8ccef0369f006b6c99 Mon Sep 17 00:00:00 2001
From: Javier Fuentes <j.fuentes.m@icloud.com>
Date: Mon, 13 Apr 2020 15:00:12 -0400
Subject: [PATCH 2/2] fixed template

---
 conf/zeppelin-site.xml.template | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/conf/zeppelin-site.xml.template b/conf/zeppelin-site.xml.template
index b7fa7afd75c..0f03a918ac7 100755
--- a/conf/zeppelin-site.xml.template
+++ b/conf/zeppelin-site.xml.template
@@ -528,8 +528,8 @@
 <!--
 <property>
     <name>zeppelin.server.send.jetty.name</name>
-    <value>true</value>
-    <description>If set to true, will not show the Jetty version to prevent Fingerprinting</description>
+    <value>false</value>
+    <description>If set to false, will not show the Jetty version to prevent Fingerprinting</description>
 </property>
 -->