'JBOSS EAP 7 - Disable Trace Method
For security findings, we would like to disable certain HTTP methods like DELETE, TRACE in JBoss EAP 7. Is there a way to do this by using JBoss configuration?
Solution 1:[1]
You can set the disallowed-methods on the Undertow subsystem. TRACE is disabled by default. With CLI it would look something like:
/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=disallowed-methods, value=["TRACE", "DELETE"])
This can also be done in the Web Console as well.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | James R. Perkins |