title: How to TEST if TRACE, OPTIONS http methods are disabled in Tomcat 7
body: <p>I am trying to disable TRACE and OPTIONS methods in the Tomcat level. I've been trying out different ways to implement this but get the same result on all cases during testing. I'm not very familiar with telnet (or any networking) but my manner of testing in cmd prompt is "telnet localhost 8080", then I paste the TRACE / HTTP/1.0 then press enter twice. Any help is greatly appreciated.</p>
  
  <p>1.) <strong>NO CHANGES</strong> in CATALINA_HOME/conf/web.xml</p>
  
  <p>2.) Adding security constraint in CATALINA_HOME/conf/web.xml</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
         &lt;web-resource-name&gt;All Access&lt;/web-resource-name&gt;
         &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
         &lt;http-method&gt;OPTIONS&lt;/http-method&gt;
         &lt;http-method&gt;TRACE&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint /&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>3.) Add allowTrace="false" in Connector tag of CATALINA_HOME/conf/server.xml</p>
  
  <p>4.) Add allowTrace="false" in Connector tag of CATALINA_HOME/conf/server.xml &amp;
  Add xml to CATALINA_HOME/conf/web.xml's Default Servlet tag</p>
  
  <pre><code>&lt;init-param&gt;
     &lt;param-name&gt;readonly&lt;/param-name&gt;
     &lt;param-value&gt;true&lt;/param-value&gt;
  &lt;/init-param&gt;
  </code></pre>
  
  <hr />
  
  <p><strong>Results on all cases</strong></p>
  
  <p>TRACE / HTTP/1.0 (404 Not Found)</p>
  
  <p>OPTIONS / HTTP/1.0 (404 Not Found)</p>
  
  <p>TRACE /(name of webservice) HTTP/1.0 (302 Found)</p>
  
  <p>OPTIONS /(name of webservice) HTTP/1.0 (302 Found)</p>
  
  <p>Tomcat was restarted after every change by issuing <em>shutdown.bat</em> and <em>startup.bat</em>. I'm obviously doing something wrong (testing/config) because I get the same result no matter what I change. I've read that I should be expecting a 405 error to signify that the http methods have been disabled.</p>