HTTP DELETE Method Enabled

Products

• CA Process Automation Base

Issue/Introduction

After upgraded to 4.3.5 client found HTTP DELETE Method Enabled and asked  is it possible to disable it?
Is the http DELETE method used and if it can be disabled?

Environment

Release : 4.3

Resolution

You can disable the http delete method.

The Fix:

1. Navigate to installation_dir\server\c2o\deployers\jbossweb.deployer and locate web.xml

2. Take backup of web.xml.

3. Open web.xml and search for <http-method>TRACE</http-method>, add <http-method>OPTIONS</http-method> just below it and save the file. Restart the server.

4. In case of cluster make this change in all nodes and restart them.