<p>I need to <strong>disable PUT, DELETE &amp; TRACE HTTP requests</strong> on my Application Server, Apache Tomcat 6.0.</p>

<p>All other sources, i have searched till now, have directed me towards the limit parameter in <em>httpd.conf</em>, Hence I'd put it before-hand that I am not using Apache Web Server, and requests are directly being handled by Tomcat, and so there is no <em>httpd.conf</em> in picture.</p>

<p>Please suggest how should I do it on Tomcat?</p>

Inside your WEBINF, add you can add a security constraint:
```
```
<security-constraint>
     <web-resource-collection>
          <web-resource-name>Forbidden</web-resource-name>
          <url-pattern>/blah/*</url-pattern>
          <http-method>PUT</http-method>
          <http-method>DELETE</http-method>
          <http-method>TRACE</http-method>
     </web-resource-collection>
     <auth-constraint>
          <role-name>empty_role</role-name>
     </auth-constraint>
</security-constraint>
```
```
Alternatively, you can do these two things:
In server.xml, edit the
```
<connector>
```
element, add an attribute:
```
allowTrace="false"
```
.  Then edit the DefaultServlet: $CATALINA_HOME/conf/web.xml
```
```
<servlet>
    <servlet-name>default</servlet-name>
    <servlet-class>
        org.apache.catalina.servlets.DefaultServlet
    </servlet-class>
    <!-- blah blah blah -->
    <init-param>
        <param-name>readonly</param-name>
        <param-value>true</param-value>
    </init-param>
</servlet>
```
```