CODEWITHSUNDEEP
jettyembedded-jetty
Harish Dalmia
Harish Dalmia

Reputation: 138

Embedded Jetty allowing HTTP TRACE / TRACK Methods

I was trying to figure out the jetty doc on the HTTP Trace and Track but could not find much. Is this statement true - "HTTP trace is disabled by default, but for embedded it is still enabled. " ? If it is, can someone please share the embed jetty doc link on how to disable it?

Thank you

Upvotes: 1

Views: 565

Answers (1)

Joakim Erdfelt
Joakim Erdfelt

Reputation: 49487

First, there is no "Track" method.

When using a WebApp, aka a WAR file (or exploded WAR file), the default descriptor will disable the HTTP TRACE method.

This is true for Standalone Jetty, and Embedded Jetty.

If you want to enable the TRACE method, you have to supply a custom default descriptor to the WebApp that wants to honor the TRACE method. (Using the WebAppContext.setDefaultDescriptor(String) method in embedded, or in XML)

If you are using something that isn't a WebApp (eg: a Handler, a ScopedHandler, a ServletContextHandler, etc) then you have no restrictions on TRACE method usage.

Once you have TRACE enabled, it's up to your chosen web library to answer that method, as Jetty itself will not participate with production of the TRACE response.

Upvotes: 1

Related Questions