Spring HiddenHttpMethodFilter and blocking HTTP methods - spring

Question

I am only allowing GET and POST methods in my Spring 3.2 application.
Though I use Spring's HiddenHttpMethodFilter which uses _method parameter to support various PUT, DELETE controller request mappings.
But security is saying that our servers allow various insecure methods like OPTIONS , TRACE and others since they can see the Allow header in response when they manipulate the _method value.
Is it really a security threat ?
And is it possible to use _method for only PUT and DELETE ?

Answer 1

In Spring MVC by default the OPTIONS and TRACE methods are not dispatched to controllers, even if you configure controllers to handle those methods. So by default Spring MVC protects prevents those methods from being used,even though the Accept header shows them as available.
These defaults can be changed in the following way if needed:
<servlet>
<servlet-name>mvc-dispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>1</load-on-startup>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring/your-mvc-dispatcher-servlet.xml</param-value>
</init-param>
<init-param>
<param-name>dispatchOptionsRequest</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>dispatchTraceRequest</param-name>
<param-value>true</param-value>
</init-param>
</servlet>
If needed the contents of the Accept header can be customized like this:
#RequestMapping(value = "/someurl", method = RequestMethod.GET)
public ResponseEntity tryOptions(HttpSession session) throws Exception {
... controller logic ...
HttpHeaders headers = new HttpHeaders();
headers.set("Allow","POST, GET");
return new ResponseEntity(headers, HttpStatus..SOME_STATUS_CODE);
}