Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have this issue with web application inspection software. the recommendation was to disable OPTION METHODS on the webserver.

upon research. i have included this snippet on my httpd.conf then restarted the server.

LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS)
RewriteRule .* - [F]

how can i verify if the code is implemented and will block all OPTIONS request?

i have tried this

curl --request OPTIONS http://10.1.1.1/mysite

but all i get is 301 Moved Permantently

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://10.1.1.1/mysite">here</a>.</p>
<hr>
<address>Apache/2.2.22 (Ubuntu) Server at 10.1.1.1 Port 80</address>
</body></html>
share|improve this question

1 Answer 1

Rather than using mod_rewrite, you should be able to disable arbitrary methods using the Limit or LimitExcept directives which are designed to to just what you want.

You can test using nc or telnet to talk directly to the httpd process

$ nc yourhost.tld 80
OPTIONS / HTTP/1.1
Host: yourhost.tld

 (press enter a couple of times here and the server responds)

HTTP/1.1 200 OK
Date: Mon, 16 Dec 2013 09:16:40 GMT
Server: Apache
Allow: GET,HEAD,POST,OPTIONS,TRACE
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
$
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.