Oracle HTTP Server

You can choose to install Oracle HTTP Server during the installation of Foundation Services, using the Oracle HTTP Server silent installer. You can also configure Oracle HTTP Server to a shared drive location to simplify configuration in a distributed environment.

To limit the information the web server presents, make the following changes in httpd.conf:

Table 5-2 httpd.conf Entries

httpd.conf Entry Description 
ServerTokens Prod

Configures the web server to not send any version numbers in the HTTP header.

 
ServerSignature Off

Configures the web server to hide the server version in the footer of server generated pages. 

Header always unset "X-Powered-By"

Hides "X-Powered-By" and Server headers sent by downstream application servers. 

<IfModule headers_module>
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
</IfModule>

Secures the cookie if SSL is enabled.