I am working on some security vulnerabilities and one of them to set http response status code to 404 for Error.page.
I have a validation methods which validates against URLs and parameters. Upon failure, We had to write a method which explicitly, redirects request to an Error.page. Redirect works for it returns 200 status code instead of 404.
Below checks are done,
- Default.site has valid Error.page.
- I created page pre-controller and add it to Error.page to set httpstatus code to 404.
- I can see log statements that it is going into pre-controller but Still not seeing http response status code 404.
Below is my pre-controller that I have created.
package com.****.pkg.ls.precontroller;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import com.interwoven.livesite.common.web.ForwardAction;
import com.interwoven.livesite.runtime.RequestContext;
public class ErrorPreController {
public static final Log mLogger = LogFactory.getLog(ErrorPreController.class);
public ForwardAction doErrorPagePreset(RequestContext ctx) {
mLogger.debug("PreController Setting up httpstatus code to 404 - Error page: " + ctx.getMasterSite().getErrorPage());
ctx.getResponse().setStatus(HttpServletResponse.SC_NOT_FOUND);
return null;
}
}
Any help on this is much appreciated.
Thank you