@Test
  public void testHttpMethods() throws Exception {
    // HTTP TRACE method should be disabled for security
    // See https://www.owasp.org/index.php/Cross_Site_Tracing
    URL url = new URL(baseUrl, "/echo?a=b");
    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
    conn.setRequestMethod("TRACE");
    conn.connect();
    assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
  }
Verify the administrator access for /logs, /stacks, /conf, /logLevel and /metrics servlets.
hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestHttpServer.java