Last updated on June 15th, 2016 at 09:56 am
Disable TRACE and TRACK method Apache Using Htaccess or HTTPD.CONF
An attacker may manipulate the TRACE
and TRACK
methods to intercept your visitors’ sensitive data. The solution, of course, is disable these methods on your webserver. This is a security vulnerability found in Apache servers.So to disable this just add the below lines.You can add this httpd.conf or .htaccess
How to disable the TRACE and TRACK methods
To disable TRACE
and TRACK
HTTP methods on your Apache-powered webserver, add the following directives to either your main configuration file or root HTAccess file:
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
These directives disable the TRACE
and TRACK
methods via the following process:
RewriteEngine on
— enables Apache’s rewrite module (this directive is not required if already present in your htaccess file)RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
— targets all TRACE and TRACK request methods for the following ruleRewriteRule .* - [F]
— return a403 Forbidden
error response for all matched conditions (i.e., all TRACE and TRACK methods)
(NOTE:- Page updated on 15th Jun 2016. Originally posted on 2nd October 2009)