Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a RHEL4 server with apache 2.0.52. I want to disable trace method and redirect all http requests to https both at the same time in one virtualhost. I have done foll.

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [L,R]

Both the rewrite rule work independently. But when put together, trace method is not disabled. The output of trace via telnet is

HTTP/1.1 302 Found
Date: Mon, 02 Nov 2009 01:34:04 GMT
Server: Apache/2.0.52 (Red Hat)
Location: https://192.168.0.174/error/noindex.html
Content-Length: 304
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://192.168.0.174/error/noindex.html">here</a>.</p>
<hr>
<address>Apache/2.0.52 (Red Hat) Server at 192.168.0.174 Port 80</address>
</body></html>
Connection closed by foreign host.
share|improve this question
    
You didn't show what your combined attempt looks like-- van you do that? –  Devin Ceartas Nov 2 '09 at 12:44
    
Sorry, I dint understand what you mean by 'combined attempt'. The output of trace command above, happens when I use both the rules together. –  amol Nov 4 '09 at 7:51
add comment

3 Answers

up vote 0 down vote accepted

I do not recollect how I figured out but the foll. rewrite rules work. The sequence is - first the https redirection rule should be present and then the trace disable rule should be present. Also I removed the L present in https redirection rule, since it is the first rule. So finally the rewrite rules look like :

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R]
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
share|improve this answer
add comment

You'll need to apply an [L] last flag to your first rule if you wish the request to stop there.

If you wish to disable TRACE requests completely (server wide) then you might want to use the TraceEnable directive instead.

share|improve this answer
add comment

I don't know why you want to use mod_rewrite for this at all. There's a simple directive for allowing or denying the HTTP method TRACE: TraceEnable.

share|improve this answer
    
TraceEnable is only supported from apache version 2.0.55. –  amol Nov 4 '09 at 7:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.