Home / Linux / Disable Trace HTTP Request In Apache

Disable Trace HTTP Request In Apache

 

Objective

By default, the HTTP TRACE request method is enabled in Apache web server.

Having this enabled can allow Cross Site Tracing attack and potentially give an option to a hacker to steal cookie information.

Solution

Disable the HTTP TRACE request method.

Edit your Apache configuration file  /etc/httpd/conf/httpd.conf  or  /etc/apache/httpd.conf  and add the following:

# Disable the HTTP TRACE request method
TraceEnable off

Reload Apache

[root@localhost]#   systemctl reload httpd.service

Use the online Request Method Security Scanner to remotely check your site for which HTTP request methods are allowed. It should list the TRACE method as “Method Not Allowed (405).”

My System Configuration

  • CentOS 7
  • Apache 2.4

 

About hvanhtuan

Leave a Reply

Your email address will not be published. Required fields are marked *

Contact me
instagram
sms
skype
whatsapp
telegram
phone
email
linkedin
viber
link
Contact Me on Zalo