18

How can I enable the handling of all HTTP methods as defined in RFC 2616 on Apache web server ? These would be:

OPTIONS
GET
HEAD
POST
PUT
DELETE
TRACE
CONNECT

I am using the Apache HTTP Server, version 2.2.22 (Ubuntu)
Here is my .htaccess File:

<Location /output>
        Dav On
    <LimitExcept GET HEAD OPTIONS PUT>
        Allow from all
    </LimitExcept>
</Location>

Here is the output I get from running Telnet – There is no PUT method:

Escape character is '^]'.
OPTIONS / HTTP/1.0

HTTP/1.1 200 OK
Date: Tue, 09 Oct 2012 06:56:42 GMT
Server: Apache/2.2.22 (Ubuntu)
Allow: GET,HEAD,POST,OPTIONS
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html

Connection closed by foreign host.

Any thoughts on this?

3
  • what version of apache to you use?
    – MaVRoSCy
    Oct 8, 2012 at 13:12
  • Server version: Apache/2.2.22 (Ubuntu)
    – MatandDie
    Oct 8, 2012 at 13:16
  • 2
    You're limiting the methods on the /output location, but you're asking for OPTIONS on the / location. Method limits do not apply to parent locations, only to deeper locations.
    – lanzz
    Oct 15, 2012 at 8:14

6 Answers 6

7

Apache implements all relevant HTTP methods for static content (actual files served directly by Apache). For dynamic content (CGI scripts, mod_php, etc), Apache does not care what the HTTP method is (unless it is explicitly restricted with a <Limit> directive), and passes the request to the appropriate handler as it is. Your script needs to handle the specific method as intended, not Apache. Even non-standard methods are passed to dynamic handlers with no problem.

Tested with an invalid ASDFG / HTTP/1.1 request handled by a mod_php script. No complaint from Apache, received ASDFG in $_SERVER['REQUEST_METHOD'] in the handler script.

2
  • Thanks for your answer. I edited my .htaccess file to allow some http methods. I checked with OPTIONS / HTTP/1.0 over telnet. Allowed http methods never changed. This issue is not about apache maybe, but it is a still problem for me to enable all http method.
    – MatandDie
    Oct 8, 2012 at 14:54
  • You should probably post exactly what you're trying, what response you are expecting to see, what you see instead, and how you handle those requests on the server side. Nothing should be stopping an OPTIONS request, unless you explicly forbid it with <Limit OPTIONS> deny from all </Limit> or a similar access control.
    – lanzz
    Oct 8, 2012 at 15:08
2

based on http://httpd.apache.org/docs/current/mod/core.html , these methods can be modified in the directory and .htaccess configuration files using the Limit method [method] ... > ... </Limit> directive

Basically you have to comment out options like the ones below which are used to block the methods.

<Limit POST PUT DELETE>
  Require valid-user
</Limit>
0
1

Probably you're using libapache2-mod-php5filter instead of libapache2-mod-php5.

Details: apache2 and php5: module or filter

1

The sure way to fix this is to learn why Apache denies the requests in your particular case. You can learn this from error logs.

In my case, tail -f /usr/local/apache/logs/error_log gave this:

[Sun Sep 18 08:39:52.570672 2016] [:error] [pid 32076:tid 140086307448576] 
[client 93.125.93.77] ModSecurity: Access denied with code 501 (phase 2). 
Match of "rx ^((?:(?:POS|GE)T|OPTIONS|HEAD))$" against "REQUEST_METHOD" 
required. [file "/usr/local/apache/conf/modsec-imh/01_base_rules.conf"] [line 
"32"] [id "960032"] [msg "Method is not allowed by policy"] [severity 
"CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [hostname "104.244.122.237"] 
[uri "/products/order/items/45"] [unique_id "V96LGGj0eu0AAH1MR8sAAACB"]

It mentions a security rule and the file it's coming from: /usr/local/apache/conf/modsec-imh/01_base_rules.conf. Editing that file solved my problem.

0

I have to suggest people to mark out or change the IP you post. That only give hackers a sure target to go for. Be careful what you post.

-1

PHP Document has a references section for this http://php.net/manual/en/features.file-upload.put-method.php

The apache core documentation for the directive is at http://httpd.apache.org/docs/2.2/mod/mod_actions.html

1

You must log in to answer this question.