5

I am using apache as a reverse proxy to a ruby on rails application server. When a HTTP request is received with a non-standard HTTP method, this causes an error in the application server that exposes some (minor) details about the environment. Can I prevent apache from forwarding requests unless the HTTP method matches one of the safe, standard methods?

[EDIT]

Using Shane's answer as a guide, I came up with the following, posting here for reference.

RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|POST|OPTIONS)
RewriteRule .* - [R=405,L]

I found that negating the check is easier, allows apache to return the correct response code (405 is method not allowed), and means that all of the proxy config stuff is unchanged (i.e. you can use ProxyPass or ProxyPassMatch)

5

Should be able to accomplish this with <Limit>:

<Limit GET HEAD POST>
  ProxyPass / http://example.com/
</Limit>

Edit:

Picky directives.. we'll go with plan B.

RewriteCond %{REQUEST_METHOD} ^(GET|HEAD|POST)$
RewriteRule ^/(.*)$ http://example.com/$1 [P,L]
| improve this answer | |
  • 2
    ProxyPass cannot occur within <Limit> or <LimitExcept> – Slicedpan Jan 16 '14 at 16:07
  • 1
    @Slicedpan Weak. See edit for an alternative that should actually work.. – Shane Madden Jan 16 '14 at 16:16
  • Hmm gonna have to play around with it a bit, but thanks for putting me on the right track. – Slicedpan Jan 16 '14 at 16:32
0

If Apache reverse proxy is used, all HTTP methods can be allowed by using directive:

<VirtualHost *:80>
    ServerName ....com

    <Proxy "*">
     Order deny,allow
     Allow from all
     AllowMethods GET PUT DELETE POST
    </Proxy>

    ProxyPass    ...
</VirtualHost>
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.