Home / server / Questions / 503685
Accepted
andreas-h
Asked: 2013-04-30 12:56:28 +0800 CST

How to forbid HTTP TRACE in lighttpd

  • 772

In a recent PCIDSS scan at a client of mine, I got aware of Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability (CVE-2004-2320, CVE-2007-3008). The proposed mitigation for Apache is this:

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{REQUEST_METHOD} ^TRACE
  RewriteRule .* - [F]
</IfModule>

How can I achieve the same in Lighttpd?

Your help is greatly appreciated!

http

1 Answers

  1. Best Answer

    See src/keyvalue.c for a list of HTTP methods recognized by lighttpd. The default configuration supports a subset of those.

    • 1