# How to disable HTTP OPTIONS method

**URL:** <https://forum.opensearch.org/t/how-to-disable-http-options-method/20537>\
**Category:** OpenDistro\
**Tags:** security-issue\
**Created:** [July 26, 2024, 5:56am UTC](https://forum.opensearch.org/t/how-to-disable-http-options-method/20537 "2024-07-26T05:56:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhupendra](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Bhupendra](https://forum.opensearch.org/u/Bhupendra)\
**Post date:** [July 26, 2024, 5:56am UTC](https://forum.opensearch.org/t/how-to-disable-http-options-method/20537/1 "2024-07-26T05:56:55Z")

</div>

How can I disable HTTP OPTIONS method on port 9200.  
This is a vulnerability raised by our customers.

---

<div class="post-metadata">

**Author:** ![yeonghyeonKo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/yeonghyeonko/32/8202_2.png) [@yeonghyeonKo](https://forum.opensearch.org/u/yeonghyeonKo)\
**Post date:** [July 29, 2024, 2:06am UTC](https://forum.opensearch.org/t/how-to-disable-http-options-method/20537/2 "2024-07-29T02:06:04Z")

</div>

@Bhupendra Hi, do you want both **HTTP** (80) and **HTTPS** (443) to be prevented for connecting customers to your hosted OpenSearch Cluster? (or Only for **HTTP** protocol?)

---

<div class="post-metadata">

**Author:** ![Bhupendra](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Bhupendra](https://forum.opensearch.org/u/Bhupendra)\
**Post date:** [July 29, 2024, 2:24am UTC](https://forum.opensearch.org/t/how-to-disable-http-options-method/20537/3 "2024-07-29T02:24:28Z")

</div>

@yeonghyeonKo , the need is not to disable port 80/443.  
On port 9200 HTTP OPTIONS is enabled.  
One way to identify this is by firing a curl command e.g. curl -v -X OPTIONS [http://localhosts:9200](http://localhosts:9200)  
The response is a list of HTTP methods that are available.  
Expectation is to disable the HTTP OPTIONS method like it can be for apache/jetty/iis.

---

<div class="post-metadata">

**Author:** ![Bhupendra](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Bhupendra](https://forum.opensearch.org/u/Bhupendra)\
**Post date:** [August 1, 2024, 12:59pm UTC](https://forum.opensearch.org/t/how-to-disable-http-options-method/20537/4 "2024-08-01T12:59:33Z")

</div>

Can someone please guide and help.

---

<div class="post-metadata">

**Author:** ![Bhupendra](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Bhupendra](https://forum.opensearch.org/u/Bhupendra)\
**Post date:** [September 16, 2024, 11:06am UTC](https://forum.opensearch.org/t/how-to-disable-http-options-method/20537/5 "2024-09-16T11:06:41Z")

</div>

Any response would be helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [November 15, 2024, 11:07am UTC](https://forum.opensearch.org/t/how-to-disable-http-options-method/20537/6 "2024-11-15T11:07:21Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.