how to restrict http methods

[kiranmca04]

Hi

I am using Apache webserver, i would like to restrict some of the http methods (DELETE, TRACE) for security reasons. I am not looking for for specific directory I want these methods should be restricted when a request made to the server, this is to avoid security threats. Please help me in this.

-Kiran

[Luuk]

The answer is in the docs.

<Limit DELETE>
    AllowOverride
    Order allow,deny
    Deny from all
 </Limit>

(see: http://httpd.apache.org/docs/2.2/mod/core.html#limit

[lisaflorence]

restrict HTTP in web.xml methods by the following code
<security-constraint>
<web-resource-collection>
<web-resource-name>restricted methods</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>TRACE</http-method>
<http-method>PUT</http-method>
<http-method>OPTIONS</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint />
</security-constraint>

[Luuk]

@lisaflorence: where, in apache, do you expect the reader of your message to put that?

I'm not new to apache, but never seen a 'web.xml' in any configuration part of apache......