I am trying to limit the use of certain HTTP verbs on my site. I entered the following into my VirtualHost config file within the Directory element:
<Limit GET POST HEAD> Allow from all </Limit> <Limit PUT DELETE OPTIONS> Deny from all </Limit>
This seemed to work but with unexpected results:
I ran the following telnet/HTTP commands before and after this change,
open server 80 OPTIONS server/abs_path HTTP/1.1 User-Agent: Telnet/1.0 Host: server
before the change I received a successful response with the Allowed headers.
After the change, however, I was expecting to receive a 405 'Method not allowed' response but rather I received a 403 'Access Forbidden' response.
What do I need to change in apache to return the 405 HTTP response?