4

I am trying to limit the use of certain HTTP verbs on my site. I entered the following into my VirtualHost config file within the Directory element:

<Limit GET POST HEAD>
 Allow from all
</Limit>
<Limit PUT DELETE OPTIONS>
 Deny from all
</Limit>

This seemed to work but with unexpected results:

I ran the following telnet/HTTP commands before and after this change,

open server 80
OPTIONS server/abs_path HTTP/1.1
User-Agent: Telnet/1.0
Host: server

before the change I received a successful response with the Allowed headers.

After the change, however, I was expecting to receive a 405 'Method not allowed' response but rather I received a 403 'Access Forbidden' response.

What do I need to change in apache to return the 405 HTTP response?

Many thanks

2
  • Apache is returning 403 because you are using deny. Can try custom errors
    – Sameer
    Feb 26, 2011 at 12:05
  • How would I add a custom error to the Limit element?
    – user72295
    Feb 26, 2011 at 13:23

1 Answer 1

4

After three hours of reviewing the apache docs and testing, I found I can use the mod_rewrite to correctly respond to unwanted HTTP methods:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} !=GET
RewriteCond %{REQUEST_METHOD} !=POST 
RewriteRule .* /error/405.html [R=405,L] 
1
  • Yes it's working on apache2.2 but i don't why LimitExcept parameter not working ! Jul 14, 2017 at 5:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .