Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am using apache as a reverse proxy to a ruby on rails application server. When a HTTP request is received with a non-standard HTTP method, this causes an error in the application server that exposes some (minor) details about the environment. Can I prevent apache from forwarding requests unless the HTTP method matches one of the safe, standard methods?

[EDIT]

Using Shane's answer as a guide, I came up with the following, posting here for reference.

RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|POST|OPTIONS)
RewriteRule .* - [R=405,L]

I found that negating the check is easier, allows apache to return the correct response code (405 is method not allowed), and means that all of the proxy config stuff is unchanged (i.e. you can use ProxyPass or ProxyPassMatch)

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Should be able to accomplish this with <Limit>:

<Limit GET HEAD POST>
  ProxyPass / http://example.com/
</Limit>

Edit:

Picky directives.. we'll go with plan B.

RewriteCond %{REQUEST_METHOD} ^(GET|HEAD|POST)$
RewriteRule ^/(.*)$ http://example.com/$1 [P,L]
share|improve this answer
    
ProxyPass cannot occur within <Limit> or <LimitExcept> –  Slicedpan Jan 16 at 16:07
    
@Slicedpan Weak. See edit for an alternative that should actually work.. –  Shane Madden Jan 16 at 16:16
    
Hmm gonna have to play around with it a bit, but thanks for putting me on the right track. –  Slicedpan Jan 16 at 16:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.