How to disable TRACE in httpd.conf

If you need to disable TRACE in httpd.conf, you can do it using the following:

# disable TRACE
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* – [F]

What is TRACE (in apache)?

The HTTP TRACE method is described in the HTTP 1.1 standard (RFC 2616, section 9.8):

9.8 TRACE
The TRACE method is used to invoke a remote, application-layer loop-
back of the request message. The final recipient of the request
SHOULD reflect the message received back to the client as the
entity-body of a 200 (OK) response.
…
If the request is valid, the response SHOULD contain the entire
request message in the entity-body, with a Content-Type of
“message/http”. Responses to this method MUST NOT be cached.

Filed under: Uncategorized by — aaron @ 8:59 pm