Apache Hardening Tutorial: Disable HTTP Trace / Cross Site Method

What is HTTP Trace ? Apache Hardening Tutorial

This article is part of the Apache Hardening and Securing tutorial series. This time we will be taking a look on HTTP Trace find how to check if you are vulnerable and how to fix it.

Apache Hardening Tutorial Series:

1- Secure Apache Web Server - Use SSLScan and Disable Ciphers:

2- Apache Secure Tutorial: Hide HTTP Header and Disable Directory Listing:

3- Apache Hardening Tutorial: Disable HTTP Trace / Cross Site Method

If your webserver has the HTTP Trace enabled this going to put it into a risk of Cross-Site Tracing and use of Cross-site Scripting (XSS).

TRACE: This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes.

The TRACE method, while it looks fine, it can be used in some scenarios to steal customers' credentials. It allows the client to see what is being received at the other end of the request.

This attack method was first discovered in 2003.

Find if your Web-server is Vulnerable

To check if the trace is enabled by default or not disabled you can use curl for that.
-k To perform insecure connection.

-X Use specified proxy

If the HTTP Trace is enabled you will be getting something similar to below output and means that you are vulnerable to cross site tracing.

User-Agent: curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Accept: */*

Disable HTTP Trace and Secure your Web-server

Add

TraceEnable Off

Save

service httpd restart

After disabling HTTP Trace try the curl command to check the status

[emanuelcarbone]

Thank you very much! I was trying to solve this problem for weeks! Greetings from Argentina.

[andersoncdz]

Thank you very much!!! It was a simple clear explanation. It helped me a lot!!!

[cncfreez]

Still missing the information how the credentials can be seen by other people. Although knowing how to disable it is nice to know.

[purvashgangolli]

thank you so much, can u please suggest me more on apache web server hardening?

[NishikantKhillare-le]

I have one doubt when used curl -- Trace -v url is getting response

[mackocour]

Is every web server with TRACE enabled considered insecure? I had this disabled by default, but I was testing other links with the method mentioned in the video and found for example my vps provider's website has this allowed.

[udhayashankar]

How to disable connect method in http proxy servers ??

[DanielMaion]

Is this disable the Trace for all httpd ports?