About error-page in web.xml

Question

I configure my error-page in web.xml ，for example: <error-page><error-code>404</error-code><location>/error.jsp</location></error-page>。

If I put a URL in browser that does not exits such as http: //localhost:8080/mywebsite/a , it will display the contents of error.jsp .But the URL in browser is not http: //localhost:8080/mywebsite/error.jsp , it is still http: //localhost:8080/mywebsite/a why ? And what to do if make the URL to be error.jsp ?

I ask this because I scan this URL using IBM AppScan, it says response status is 200 OK.

Answer 1

There is no point in re-writing the URL to show the user that he/she has hit the error page. In-fact it may expose the structure of your application that may be harmful if you are not too careful.

http://yourhost/something/invalid/url is not much helpful for any malicious user.

But

http://yourhost/pages/errorPages/404Page.jsp

exposes a lot of critical information to the user about the structure of your web-application.