I was having similar problem with the Apache 2.2.3-4 version and finally
figured out that the TRACE option must be inside the virtual host
configuration file (and not apache2.conf). Hope it helps.
Bhagwati
Foster, Stephen (ASPIRE) wrote:
We never got this to work properly.We ended up moving to 2.0.55 and using the
traceenable feature:
http://httpd.apache.org/docs/2.0/mod/core.html#traceenable
-----Original Message-----
From: Jeroen Vriezen [mailto:[EMAIL PROTECTED]
Sent: 29 May 2007 09:57
To: users@httpd.apache.org
Subject: [EMAIL PROTECTED] TRACE and Apache 2.x
Hello,
Currently we are using Apache 2.0.46. On the 1.3.x version we always used the
following mod_rewrite rule to disable the TRACE option:
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
When using these rules on Apache 2.0.46, TRACE is still possible. Beside the fact
that the whole TRACK & TRACE
"security issue" is not that interesting, I still wonder how TRACE can be
disabled in Apache 2.0.46. I've also tried the TraceEnable option but that
options seems to be supported in 2.0.55 and later only.
Hope someone can point me in the right direction.
Kind Regards,
Jeroen.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: [EMAIL PROTECTED]
" from the digest: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: [EMAIL PROTECTED]
" from the digest: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
