title: spring-boot disable HTTP methods
body: <p>For Tomcat it's fairly easy to disable certain HTTP methods. Just add to the web.xml:</p>
  
  <pre><code>    &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;restricted methods&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;http-method&gt;PUT&lt;/http-method&gt;
          &lt;http-method&gt;DELETE&lt;/http-method&gt;
          &lt;http-method&gt;HEAD&lt;/http-method&gt;
          &lt;http-method&gt;OPTIONS&lt;/http-method&gt;
          &lt;http-method&gt;TRACE&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint/&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>How do I do the same in spring-boot? <br> I've tried adding the following: </p>
  
  <pre><code>@Bean
  public EmbeddedServletContainerCustomizer containerCustomizer() {
      return new EmbeddedServletContainerCustomizer() {
          @Override
          public void customize(ConfigurableEmbeddedServletContainer container) {
              if (container.getClass().isAssignableFrom(TomcatEmbeddedServletContainerFactory.class)) {
                  TomcatEmbeddedServletContainerFactory tomcatContainer = (TomcatEmbeddedServletContainerFactory) container;
                  tomcatContainer.addContextCustomizers(new ContextSecurityCustomizer());
              }
          }
      };
  }
  
  private static class ContextSecurityCustomizer implements TomcatContextCustomizer {
      @Override
      public void customize(Context context) {
          SecurityConstraint constraint = new SecurityConstraint();
          SecurityCollection securityCollection = new SecurityCollection();
          securityCollection.setName("restricted_methods");
          securityCollection.addPattern("/*");
          securityCollection.addMethod(HttpMethod.DELETE.toString());
          constraint.addCollection(securityCollection);
          context.addConstraint(constraint);
      }
  }
  </code></pre>
  
  <p>with little success. The <code>EmbeddedServletContainerCustomizer</code> bean is created, however I can still issue DELETE requests.<br> Any ideas ?</p>