title: Java embedded jetty is accepting HTTP TRACE method
body: <p>I'm trying to disable HTTP TRACE method in embedded Jetty. In Jetty doc's is info that HTTP trace is disabled by default, but for embedded it is still enabled. I was trying to disable trace as a security constraint as is done in jetty.xml.</p>
  
  <pre><code>    ServletContextHandler servletHandler = new ServletContextHandler(ServletContextHandler.SESSIONS | ServletContextHandler.SECURITY);
      servletHandler.setClassLoader(Server.class.getClassLoader());
      servletHandler.setContextPath("/");
      servletHandler.addEventListener(new ContextLoaderListener());
      servletHandler.addServlet(new ServletHolder(new CXFServlet()), "/*");
      servletHandler.setInitParameter("contextClass", AnnotationConfigWebApplicationContext.class.getName());
      servletHandler.setInitParameter("contextConfigLocation", BeansConfig.class.getName());
      servletHandler.setInitParameter("javax.ws.rs.Application", DispatcherConfig.class.getName());
  
       /*
       * &lt;security-constraint&gt;
       * &lt;web-resource-collection&gt;
       * &lt;web-resource-name&gt;Disable TRACE&lt;/web-resource-name&gt;
       * &lt;url-pattern&gt;/&lt;/url-pattern&gt;
       * &lt;http-method&gt;TRACE&lt;/http-method&gt;
       * &lt;/web-resource-collection&gt;
       * &lt;auth-constraint/&gt;
       * &lt;/security-constraint&gt;
       */
       Constraint constraint = new Constraint();
       constraint.setName("Disable TRACE");
  
       ConstraintMapping mapping = new ConstraintMapping();
       mapping.setConstraint(constraint);
       mapping.setMethod("TRACE");
       mapping.setPathSpec("/"); // this did not work same this mapping.setPathSpec("/*");
  
       ConstraintSecurityHandler securityHandler = (ConstraintSecurityHandler) servletHandler.getSecurityHandler();
       securityHandler.addConstraintMapping(mapping);
  </code></pre>
  
  <p>Example output from soapUI:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Content-Type: message/http
  Content-Length: 143
  Server: Jetty(9.0.6.v20130930)
  
  TRACE / HTTP/1.1
  Connection: keep-alive
  User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
  Host: 192.168.33.115
  Accept-Encoding: gzip,deflate
  </code></pre>