2

i have this issue with web application inspection software. the recommendation was to disable OPTION METHODS on the webserver.

upon research. i have included this snippet on my httpd.conf then restarted the server.

LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS)
RewriteRule .* - [F]

how can i verify if the code is implemented and will block all OPTIONS request?

i have tried this

curl --request OPTIONS http://10.1.1.1/mysite

but all i get is 301 Moved Permantently

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://10.1.1.1/mysite">here</a>.</p>
<hr>
<address>Apache/2.2.22 (Ubuntu) Server at 10.1.1.1 Port 80</address>
</body></html>
Improve this question

1 Answer 1

Reset to default
2

Rather than using mod_rewrite, you should be able to disable arbitrary methods using the Limit or LimitExcept directives which are designed to to just what you want.

You can test using nc or telnet to talk directly to the httpd process

$ nc yourhost.tld 80
OPTIONS / HTTP/1.1
Host: yourhost.tld

 (press enter a couple of times here and the server responds)

HTTP/1.1 200 OK
Date: Mon, 16 Dec 2013 09:16:40 GMT
Server: Apache
Allow: GET,HEAD,POST,OPTIONS,TRACE
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
$
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .