Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to limit the use of certain HTTP verbs on my site. I entered the following into my VirtualHost config file within the Directory element:

<Limit GET POST HEAD>
 Allow from all
</Limit>
<Limit PUT DELETE OPTIONS>
 Deny from all
</Limit>

This seemed to work but with unexpected results:

I ran the following telnet/HTTP commands before and after this change,

open server 80
OPTIONS server/abs_path HTTP/1.1
User-Agent: Telnet/1.0
Host: server

before the change I received a successful response with the Allowed headers.

After the change, however, I was expecting to receive a 405 'Method not allowed' response but rather I received a 403 'Access Forbidden' response.

What do I need to change in apache to return the 405 HTTP response?

Many thanks

share|improve this question
    
Apache is returning 403 because you are using deny. Can try custom errors –  Sameer Feb 26 '11 at 12:05
    
How would I add a custom error to the Limit element? –  user72295 Feb 26 '11 at 13:23
add comment

1 Answer 1

After three hours of reviewing the apache docs and testing, I found I can use the mod_rewrite to correctly respond to unwanted HTTP methods:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} !=GET
RewriteCond %{REQUEST_METHOD} !=POST 
RewriteRule .* /error/405.html [R=405,L] 
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.