Disable HTTP DELETE METHODs in Tomcat

Issues and Questions related to running Apache Tomcat on z/OS
Post Reply
mbabcock
Posts: 3
Joined: Mon Sep 25, 2017 1:25 pm

Disable HTTP DELETE METHODs in Tomcat

Post by mbabcock » Thu Oct 11, 2018 3:21 pm

How do I disable the HTTP DELETE methods in Tomcat v8.5.0?

dovetail
Site Admin
Posts: 1850
Joined: Thu Jul 29, 2004 12:12 pm

Re: Disable HTTP DELETE METHODs in Tomcat

Post by dovetail » Mon Oct 15, 2018 11:36 am

This is really a generic Tomcat question, not about our z/OS package.

Try google:

https://www.google.com/search?source=hp ... ete+method

mbabcock
Posts: 3
Joined: Mon Sep 25, 2017 1:25 pm

Re: Disable HTTP DELETE METHODs in Tomcat

Post by mbabcock » Mon Oct 15, 2018 1:45 pm

I found this on the net:

<security-constraint>
<display-name>Deny all HTTP methods except GET and POST</display-name>
<web-resource-collection>
<url-pattern>/company/*</url-pattern>
<http-method-omission>GET</http-method-omission>
<http-method-omission>POST</http-method-omission>
</web-resource-collection>
<auth-constraint/>
</security-constraint>

Hopefully that works.

Luke Mikel
Posts: 1
Joined: Sun Oct 28, 2018 11:39 am

Re: Disable HTTP DELETE METHODs in Tomcat

Post by Luke Mikel » Sun Oct 28, 2018 11:42 am

mbabcock wrote:
Mon Oct 15, 2018 1:45 pm
I found this on the net:

<security-constraint>
<display-name>Deny all HTTP methods except GET and POST</display-name>
<web-resource-collection>
<url-pattern>/company/*</url-pattern>
<http-method-omission>GET</http-method-omission>
<http-method-omission>POST</http-method-omission>
</web-resource-collection>
<auth-constraint/>
</security-constraint>

Hopefully that works.
That part is not functioning well.
Try updating the version may solve the issue as it has builtin delete methods.

Post Reply