title: Insecure HTTP Methods Enabled - How to disable
body: <p>We are running rational app scan on our app URL and it comes back with the following result:</p>
  
  <p>It seems that the 
  web server is configured to allow one (or more) of the following HTTP methods 
  (verbs)
  - DELETE
  - SEARCH
  - COPY
  - MOVE
  - PROPFIND
  - PROPPATCH
  - MKCOL
  - LOCK
  - UNLOCK
  - PUT</p>
  
  <p>To fix this I added a RewriteRule to forbid any of these methods. Now when I test manually I get response code 403:</p>
  
  <pre><code>curl -X PUT https://someurl.com/somecontext/somepage.xhtml
  
  &lt;!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"&gt;
  &lt;html&gt;&lt;head&gt;
  &lt;title&gt;403 Forbidden&lt;/title&gt;
  &lt;/head&gt;&lt;body&gt;
  &lt;h1&gt;Forbidden&lt;/h1&gt;
  &lt;p&gt;You don't have permission to access /somecontext/somepage.xhtml
  on this server.&lt;/p&gt;
  &lt;/body&gt;&lt;/html&gt;
  </code></pre>
  
  <p>But rational app scan still shows this as a problem. Has anyone encountered the same problem. This URL goes to a tomcat backend via AJP. Would appreciate solution for this.</p>
  
  <p>PS: I had Limit and LimitExcept in mind but I am not sure if it will block the requests that go via mod_proxy or mod_jk</p>