If you’ve ever run a security scan, you might have seen this warning: the HTTP OPTIONS method is enabled on your web server. Let me explain what that means and how I deal with it.
The OPTIONS method returns the list of methods the server supports. In other words, it tells anyone who asks what they’re allowed to do on a given URL.
Why it matters
The problem is that this information can help an attacker. Knowing which methods are available makes it easier to plan a more advanced attack. So the advice is simple: turn OPTIONS off.
How to disable it
I disable it by adding a <security-constraint> to tomcat/conf/web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>restricted methods</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>OPTIONS</http-method>
</web-resource-collection>
<auth-constraint />
</security-constraint>After that, restart tomcat and you’re done.