Removing 'Allow' response header <p>I have a web-app developed using Spring-MVC, Spring-Security and hosted on Tomcat 7. As a security measure, I have also whitelisted only certain HTTP methods in web.xml as follows:</p> <pre><code>&lt;security-constraint&gt; &lt;web-resource-collection&gt; &lt;web-resource-name&gt;restricted methods&lt;/web-resource-name&gt; &lt;url-pattern&gt;/*&lt;/url-pattern&gt; &lt;http-method-omission&gt;GET&lt;/http-method-omission&gt; &lt;http-method-omission&gt;POST&lt;/http-method-omission&gt; &lt;http-method-omission&gt;DELETE&lt;/http-method-omission&gt; &lt;/web-resource-collection&gt; &lt;auth-constraint /&gt; &lt;/security-constraint&gt; </code></pre> <p>At this point, what I would expect is that if I made an excluded http method call to any endpoint, then I would get a 403 response - and this setup works. But the 403 response also includes a "Allow" header as follows:</p> <pre><code>Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH </code></pre> <ol> <li>Is blacklisting OPTIONS not a supported/recommended thing?</li> <li>Why is the list of allowed http methods different from what I have configured?</li> <li>I'm assuming Tomcat is the one adding the Allow header to the response - is that right?</li> <li>And how can I configure tomcat (or spring if that is adding the header) to not add this header to the response?</li> </ol>