up vote 0 down vote favorite
share [g+] share [fb]

I have a RHEL4 server with apache 2.0.52. I want to disable trace method and redirect all http requests to https both at the same time in one virtualhost. I have done foll. 

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [L,R]

Both the rewrite rule work independently. But when put together, trace method is not disabled. The output of trace via telnet is 

HTTP/1.1 302 Found
Date: Mon, 02 Nov 2009 01:34:04 GMT
Server: Apache/2.0.52 (Red Hat)
Location: https://192.168.0.174/error/noindex.html
Content-Length: 304
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://192.168.0.174/error/noindex.html">here</a>.</p>
<hr>
<address>Apache/2.0.52 (Red Hat) Server at 192.168.0.174 Port 80</address>
</body></html>
Connection closed by foreign host.
link|improve this question
50% accept rate
You didn't show what your combined attempt looks like-- van you do that? – Devin Ceartas Nov 2 '09 at 12:44
Sorry, I dint understand what you mean by 'combined attempt'. The output of trace command above, happens when I use both the rules together. – amol Nov 4 '09 at 7:51
feedback

3 Answers

up vote 0 down vote accepted

I do not recollect how I figured out but the foll. rewrite rules work. The sequence is - first the https redirection rule should be present and then the trace disable rule should be present. Also I removed the L present in https redirection rule, since it is the first rule. So finally the rewrite rules look like :

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R]
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
link|improve this answer
feedback
up vote 0 down vote

You'll need to apply an [L] last flag to your first rule if you wish the request to stop there.

If you wish to disable TRACE requests completely (server wide) then you might want to use the TraceEnable directive instead.

link|improve this answer
feedback
up vote 0 down vote

I don't know why you want to use mod_rewrite for this at all. There's a simple directive for allowing or denying the HTTP method TRACE: TraceEnable.

link|improve this answer
TraceEnable is only supported from apache version 2.0.55. – amol Nov 4 '09 at 7:48
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.