How to Disable the HTTP OPTIONS in OneClick's Tomcat Server
search cancel

How to Disable the HTTP OPTIONS in OneClick's Tomcat Server

book

Article ID: 190976

calendar_today

Updated On:

Products

Spectrum Network Observability

Issue/Introduction

The HTTP OPTIONS method is used to describe the communication options for the target resource. When enabled, a client can send a request to the tomcat server asking for allowed methods. It is possible that this might be used for malicious intent to identify allowed methods to use in a potential attack. It is not used operationally by Spectrum and so can be safely blocked.

This knowledge document explains how to disable the HTTP OPTIONS method.

Environment

DX NetOps Spectrum all currently supported releases

Cause

To disable the HTTP OPTIONS method in the Spectrum Tomcat server (OneClick), you must define a <security-constraint> inside the server's web.xml file.

This configuration will generate a HTTP 403 Forbidden error whenever a client tries to issue an unauthorized OPTIONS request and so prevent disclosure of allowed methods on the server.

 

Resolution

The OPTIONS method can be disabled on the OneClick server by updating the web.xml file and adding the block below BEFORE the </web-app> closing tag (which by default is at the end of the file).

FILE:  $SPECROOT/tomcat/conf/web.xml

For example:

  1. Backup the existing web.xml
         cp -p $SPECROOT/tomcat/conf/web.xml  $SPECROOT/tomcat/conf/web.xml.backup

  2. Edit the $SPECROOT/tomcat/conf/web.xml file (add the following just before the closing </web-app> tag)

    <security-constraint>
        <web-resource-collection>
          <web-resource-name>restricted methods</web-resource-name>
          <url-pattern>/*</url-pattern>
          <http-method>TRACE</http-method>
          <http-method>PUT</http-method>
          <http-method>DELETE</http-method>
          <http-method>HEAD</http-method>
          <http-method>OPTIONS</http-method>
          </web-resource-collection>
          <auth-constraint />
      </security-constraint>

     <filter>
       <filter-name>CorsFilter</filter-name>
       <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
       <init-param>
          <param-name>cors.allowed.methods</param-name>
          <param-value>GET,POST,CONNECT</param-value>
       </init-param>
     </filter>
     <filter-mapping>
       <filter-name>CorsFilter</filter-name>
       <url-pattern>/*</url-pattern>
     </filter-mapping>

  3. Save the changes

  4. Restart OneClick tomcat


Tomcat should now block the OPTIONS method. You can verify this by running the following to test it:

curl -v -X OPTIONS http://<ONECLICK_HOST>:8080/

You will see output similar to the following:

[spectrum@OneClick]$ curl -v -X OPTIONS http://localhost:8080/

*   Trying ::1...

* TCP_NODELAY set

* Connected to localhost (::1) port 8080 (#0)

> OPTIONS / HTTP/1.1

> Host: localhost:8080

> User-Agent: curl/7.61.1

> Accept: */*

> 

< HTTP/1.1 403 

< Cache-Control: private

< Content-Type: text/html;charset=utf-8

< Content-Language: en

< Content-Length: 431

< Date: Fri, 19 Jun 2026 02:09:50 GMT

< 

* Connection #0 to host localhost left intact

<!doctype html><html lang="en"><head><title>HTTP Status 403 – Forbidden</title><style>HTTP Status 403 – Forbidden</h1></b

Powered by Wolken Software