# Disabling OPTIONS and DELETE in Apache

**URL:** <https://forum.servoy.com/t/disabling-options-and-delete-in-apache/20075>\
**Category:** Classic Servoy\
**Created:** [August 28, 2019, 1:53pm UTC](https://forum.servoy.com/t/disabling-options-and-delete-in-apache/20075 "2019-08-28T13:53:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bcusick](https://avatars.discourse-cdn.com/v4/letter/b/ed8c4c/32.png) [@bcusick](https://forum.servoy.com/u/bcusick)\
**Post date:** [August 28, 2019, 1:53pm UTC](https://forum.servoy.com/t/disabling-options-and-delete-in-apache/20075/1 "2019-08-28T13:53:26Z")

</div>

Hey Folks,

Our compliance and security team regularly scans all servers for potential security leaks. They want the OPTIONS and DELETE disabled on the Servoy app server. After searching for a while - I found the snippet I was looking for:

```auto
<security-constraint>
     <web-resource-collection>
          <web-resource-name>Forbidden</web-resource-name>
          <url-pattern>/*</url-pattern>
          <http-method>OPTIONS</http-method>
          <http-method>DELETE</http-method>
     </web-resource-collection>
     <auth-constraint />
</security-constraint>

```

I’m not sure where to place it in the web.xml config file… when I try to just place it at the end - the service won’t start - with this error:

```auto
ERROR [WrapperSimpleAppMain] com.servoy.j2db.util.Debug - Cannot load mime type mappings from web.xml: 
org.xml.sax.SAXParseExceptionpublicId: C:\Servoy_7_4\application_server\server\conf\web.xml; lineNumber: 4668; columnNumber: 2; The markup in the document following the root element must be well-formed.
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.fatalError(Unknown Source)
	at com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(Unknown Source)
	at com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(Unknown Source)
	at com.sun.org.apache.xerces.internal.impl.XMLScanner.reportFatalError(Unknown Source)
	at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$TrailingMiscDriver.next(Unknown Source)
	at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(Unknown Source)
	at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(Unknown Source)
	at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown Source)
	at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(Unknown Source)
	at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(Unknown Source)
	at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(Unknown Source)
	at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(Unknown Source)
	at com.servoy.j2db.server.main.Zrb.Za(Zrb.java:18)
	at com.servoy.j2db.server.main.ApplicationServer.Za(ApplicationServer.java:321)
	at com.servoy.j2db.server.main.ApplicationServer.Za(ApplicationServer.java:97)
	at com.servoy.j2db.server.main.Zob.start(Zob.java:49)
	at com.servoy.j2db.server.main.ApplicationServer.main(ApplicationServer.java:641)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.lang.reflect.Method.invoke(Unknown Source)
	at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:238)
	at java.lang.Thread.run(Unknown Source)

```

This is Servoy 7.4.10 on Java 1.8.0\_221 on Windows Server 2008

Any help would be greatly appreciated!

Bob

---

<div class="post-metadata">

**Author:** ![mboegem](https://yyz2.discourse-cdn.com/flex010/user_avatar/forum.servoy.com/mboegem/32/4399_2.png) [@mboegem](https://forum.servoy.com/u/mboegem)\
**Post date:** [August 29, 2019, 8:17pm UTC](https://forum.servoy.com/t/disabling-options-and-delete-in-apache/20075/2 "2019-08-29T20:17:27Z")

</div>

Hi Bob,

right at the end of the file, is not the correct position I believe.  
The web.xml file starts with tag and also has to end with that.  
Positioning in between those tags should be good, but personally I’d put it above the mime type mappings.

Tried this in developer, and seems to work.

---

<div class="post-metadata">

**Author:** ![bcusick](https://avatars.discourse-cdn.com/v4/letter/b/ed8c4c/32.png) [@bcusick](https://forum.servoy.com/u/bcusick)\
**Post date:** [August 30, 2019, 1:08pm UTC](https://forum.servoy.com/t/disabling-options-and-delete-in-apache/20075/3 "2019-08-30T13:08:51Z")

</div>

Marc, you sir, are a gentleman and scholar!

WORKED.

THANK YOU! I appreciate your help!!

Bob