Re: Disable http TRACE method

TRACE is handled by Apache at an earlier request phase - before
Mod_Security has a hook.  Mod_Rewrite has a hook that will allow it to
identify/block TRACE requests.

Implement mod_rewrite and then add these entries -

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE$
RewriteRule .* - [F]

-- 
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GSNA, GCUX, GSEC


On 8/18/05, David ROBERT <castlebbs@xxxxxxxxx> wrote:
> Hello,
> 
> I try to disable http TRACE methode using :
> 
> SecFilterSelective REQUEST_METHOD "^TRACE$"
> 
> It don't work, do you know why ?
> 
> David.
> 
> 
> -------------------------------------------------------
> SF.Net email is Sponsored by the Better Software Conference & EXPO
> September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
> Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
> Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
> _______________________________________________
> mod-security-users mailing list
> mod-security-users@xxxxxxxxxxxxxxxxxxxxx
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf