admin@glassfish.java.net

Disable TRACK/TRACE HTTP methods

From: Sebastian Choren <sebastianchoren_at_gmail.com>
Date: Fri, 24 Jul 2009 14:14:00 -0300

Hi. We're running a security audit on a Glassfish V2 running on Ubuntu.
According to the audit results, the server is acceptign TRACK and TRACE
request, and I need to disable it. I've been googling about this, and all I
found is a directive to add in the web.xml, but it still accepting it.
In Apache I made a RewriteRule to deny request made with TRAC or TRACE, but
in glassfish i don't know how to do something simmilar to this.

Thanks in advice!!

Sebastián Choren