How to disable or remove Allow response header from OPTIONS?

Question

I have SecurityConfig class and I have added code to disable headers but I want to disable the 'Allow' response header. I have tried many different ways but no luck. How to add a custom header to disable?

        @Configuration
    @Slf4j
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception
        {
            http.csrf().disable()
    
                    .authorizeRequests().anyRequest().authenticated()
                    .and()
                    .headers().xssProtection().disable()
                    .and().headers().frameOptions().disable()
                    .and().headers().contentTypeOptions().disable()
                    .and().headers().disable()
                    .httpBasic();
        
}
}

Rest Controller

{

@RequestMapping(value = Constants.API_BASE_MAPPING + Constants.API_EVENT, method = RequestMethod.OPTIONS)
public ResponseEntity<?> publishEventMessage() {
    return getResponseEntity();
}

private ResponseEntity<?> getResponseEntity() {
    return ResponseEntity
            .ok().contentType(MediaType.APPLICATION_JSON)
            .allow() // want to remove this 
            .build();
}
}

Below is the response header from my OPTIONS API call

Answer 1

If you want to set an empty Allow Header response in a particular method in your controller, you can use:

return ResponseEntity
       .ok().contentType(MediaType.APPLICATION_JSON)
       .header("Allow", "")
       .build();

Also, you can disable the OPTIONS http method for a certain path in your security configuration adding:

.antMatchers(HttpMethod.OPTIONS,"path/to/deny").denyAll() 

You can't delete headers after being set. One possible solution is prevent that by creating a Filter which skips the setHeader.

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    chain.doFilter(request, new HttpServletResponseWrapper((HttpServletResponse) response) {
        public void setHeader(String name, String value) {
            if (!name.equalsIgnoreCase("Allow")) {
                super.setHeader(name, value);
            }
        }
    });
}

Based on this: https://stackoverflow.com/a/7895292/3713193

How to define a filter in Spring Boot: https://www.baeldung.com/spring-boot-add-filter