Disable Stacktrace information

Question

Hi

We've got a security audit on our confluence installation and we are told that we have to disable the stacktrace information on the error pages.

I cannot find any information about that, is there a possibilitiy?

BR

Thomas

Florian Seifer · Answer

I am having the problem right now, trying to secure a Confluence-Installation after a Penetration Test.  Did you by any Chance find a solution to disable Stack Traces?

Thomas Suter · Answer

Thanks for answer.

Unfortunately I didn't find any solution for this issue in the OWASP documents or in the Tomcat documentation directly.

Does anyone have another idea?

cheers

Thomas

Jonas Andersson · Answer

Confluence and JIRA are both run on tomcat. Looking around i could not find anything about this on Atlassian pages, but apache tomcat does have a few pages about it. Check out this: https://www.owasp.org/index.php/Securing_tomcat