Geek Answers Handbook

Disabling the TRACE request method on Apache / 2.0.52

By default, Apache 2.0.52 will respond to any HTTP TRACE request it receives. This is a potential security issue because it allows you to resolve certain types of XSS attacks. For more details see http://www.apacheweek.com/issues/03-01-24#news

I am trying to disable TRACE requests by following the instructions given on the page above. I added the following lines of code to the http.conf file and restarted apache:

RewriteEngine On RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F]

However, when I submit the TRACE request to my web server, it seems to ignore the rewrite rules and respond as if the TRACE requests were still enabled.

For instance:

 [ admin2@dedicated ~]$ telnet XXXX.com 80 Trying XXXX... Connected to XXXX.com (XXXX). Escape character is '^]'. TRACE / HTTP/1.0 X-Test: foobar HTTP/1.1 200 OK Date: Sat, 11 Jul 2009 17:33:41 GMT Server: Apache/2.0.52 (Red Hat) Connection: close Content-Type: message/http TRACE / HTTP/1.0 X-Test: foobar Connection closed by foreign host.

The server should respond with 403 Forbidden. Instead, it repeats my request with 200 OK.

As a test, I changed RewriteCond to% {REQUEST_METHOD} ^ GET

When I do this, Apache correctly answers all GET requests with the forbidden 403. But when I change the GET back to TRACE, it still skips the TRACE requests.

How can I make Apache stop responding to TRACE requests?

+4
source share
3 answers

I figured out the right way to do this.

I tried to place the rewrite rule block in three places: in the <Directory "/var/www/html"> the httpd.conf file, at the top of my httpd.conf file, and in / var / www / html /. htaccess file. None of these three methods worked.

Finally, however, I tried to put a block of code in the <VirtualHost *:80> part of my httpd.conf. For some reason, it works when it is placed. there is.

+1
source

Some versions require:

TraceEnable Off

+1
source

As you said, this works in your VirtualHost block. Since you did not show httpd.conf, I can’t say why your initial attempt did not work - it is context-sensitive.

Failed, because in fact it is not relevant, which is usually for access control. If it does not work in .htaccess, it is likely that apache is not looking for it (you can use AllowOverride to enable them).

+1
source

More articles:


All Articles