1 Reply Latest reply on Jun 15, 2003 12:56 PM by Jon Barnett


    brianm Newbie

      We just loaded JBOSS 3.2.1 and now our network scans show "httptraceenabled". Without using Apache or IIS, how do we disable httptrace?

        • 1. Re: httptraceenabled
          Jon Barnett Master

          TRACE is a necessary spec conformance for HTTP 1.1 and the doTrace method is declared out of necessity for conformance in the servlet base class javax.servlet.http.HttpServlet.

          I suppose you could provide a security constraint for <http-method>TRACE</http-method>

          I don't know that this has otherwise been addressed. The last recourse would be to either override the doTrace method for every servlet or provide a special HttpServlet class.