Disable stacktraces in Tomcat's error pages to make it ready for production

Solution 1:

The error page is generated by a simple error handler, the Error Report Valve. You can hide stack traces (showReport) as well as the server info by adding these lines to your server.xml's Host section:

<Valve className="org.apache.catalina.valves.ErrorReportValve"
    showReport="false" 
    showServerInfo="false" />  

Another solution is to use custom, user friendly error pages for every HTTP error code:

<error-page>
    <error-code>500</error-code>
    <location>/error500.jsp</location>
</error-page>

as well as for every different Throwable:

<error-page>
    <exception-type>java.lang.Exception</exception-type>
    <location>/error-Exception.jsp</location>
</error-page>

<error-page>
    <exception-type>java.sql.SQLException</exception-type>
    <location>/error-SQLException.jsp</location>
</error-page>