对于JSF的应用，你可能会在HTTP的头信息中看到这样的字样：
Server : Apache/2.0.61 (Unix) X-Powered-By : JSF/1.2
让用户知道这些消息没有太大意义，而且可能造成安全漏洞。需要屏蔽的话可以参考以下步骤：
隐藏Server信息 ：在apache里控制的,在httpd.conf里加入一行
ServerTokens Prod
隐藏X-Powered-By ：在web.xml中加入：
< context-param > < param-name > com.sun.faces.sendPoweredByHeader </ param-name > < param-value > false </ param-value > </ context-param > <context-param> <param-name>com.sun.faces.sendPoweredByHeader</param-name> <param-value>false</param-value> </context-param>对于JBoss，需要找到这个文件：<JBOSS_HOME>/server/default/deploy/jboss-web.deployer/conf/web.xml，然后加入以下代码：
< filter > < filter-name > CommonHeadersFilter </ filter-name > < filter-class > org.jboss.web.tomcat.filters.ReplyHeaderFilter </ filter-class > < init-param > < param-name > X-Powered-By </ param-name > < param-value > Servlet 2.4; JBoss-4.2.0.GA (build: SVNTag = JBPAPP_4_2_0_GA date = 200706281411 )/Tomcat-5.5 </ param-value > </ init-param > </ filter > ↓ < filter > < filter-name > CommonHeadersFilter </ filter-name > < filter-class > org.jboss.web.tomcat.filters.ReplyHeaderFilter </ filter-class > </ filter > <filter> <filter-name>CommonHeadersFilter</filter-name> <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class> <init-param> <param-name>X-Powered-By</param-name> <param-value>Servlet 2.4; JBoss-4.2.0.GA (build: SVNTag=JBPAPP_4_2_0_GA date=200706281411)/Tomcat-5.5</param-value> </init-param> </filter> ↓ <filter> <filter-name>CommonHeadersFilter</filter-name> <filter-class>org.jboss.web.tomcat.filters.ReplyHeaderFilter</filter-class> </filter>
