public static void constrainHttpMethods(ServletContextHandler ctxHandler,
    boolean allowOptionsMethod) {
    Constraint c = new Constraint();
    c.setAuthenticate(true);

    ConstraintMapping cmt = new ConstraintMapping();
    cmt.setConstraint(c);
    cmt.setMethod("TRACE");
    cmt.setPathSpec("/*");

    ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();

    if (!allowOptionsMethod) {
      ConstraintMapping cmo = new ConstraintMapping();
      cmo.setConstraint(c);
      cmo.setMethod("OPTIONS");
      cmo.setPathSpec("/*");
      securityHandler.setConstraintMappings(new ConstraintMapping[] { cmt, cmo });
    } else {
      securityHandler.setConstraintMappings(new ConstraintMapping[] { cmt });
    }

    ctxHandler.setSecurityHandler(securityHandler);
  }
Add constraints to a Jetty Context to disallow undesirable Http methods.
@param ctxHandler         The context to modify
@param allowOptionsMethod if true then OPTIONS method will not be set in constraint mapping
hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServerUtil.java