Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a RHEL4 server with apache 2.0.52. I want to disable trace method and redirect all http requests to https both at the same time in one virtualhost. I have done foll.

RewriteEngine On
RewriteRule .* - [F]
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [L,R]

Both the rewrite rule work independently. But when put together, trace method is not disabled. The output of trace via telnet is

HTTP/1.1 302 Found
Date: Mon, 02 Nov 2009 01:34:04 GMT
Server: Apache/2.0.52 (Red Hat)
Content-Length: 304
Connection: close
Content-Type: text/html; charset=iso-8859-1

<title>302 Found</title>
<p>The document has moved <a href="">here</a>.</p>
<address>Apache/2.0.52 (Red Hat) Server at Port 80</address>
Connection closed by foreign host.
share|improve this question
You didn't show what your combined attempt looks like-- van you do that? – Devin Ceartas Nov 2 '09 at 12:44
Sorry, I dint understand what you mean by 'combined attempt'. The output of trace command above, happens when I use both the rules together. – amolkul Nov 4 '09 at 7:51
up vote 0 down vote accepted

I do not recollect how I figured out but the foll. rewrite rules work. The sequence is - first the https redirection rule should be present and then the trace disable rule should be present. Also I removed the L present in https redirection rule, since it is the first rule. So finally the rewrite rules look like :

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R]
RewriteRule .* - [F]
share|improve this answer

You'll need to apply an [L] last flag to your first rule if you wish the request to stop there.

If you wish to disable TRACE requests completely (server wide) then you might want to use the TraceEnable directive instead.

share|improve this answer

I don't know why you want to use mod_rewrite for this at all. There's a simple directive for allowing or denying the HTTP method TRACE: TraceEnable.

share|improve this answer
TraceEnable is only supported from apache version 2.0.55. – amolkul Nov 4 '09 at 7:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.