mod_rewrite - deny HTTP TRACE
| From: | Lee P. Reilly | Date: | Thu, 17 Apr 2003 15:39:16 +0000 |
| Subject: | mod_rewrite - deny HTTP TRACE | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-144306@lists.php.net to get a copy of this message | ||
Hi there,
All of my PHP installations use the mod_rewrite module, which is enabled
when I build Apache. What effect would it have on PHP if I were to
remove this module? I'm getting ready to open my production server to
the world, and my company's security scan listed "HTTP TRACE Method
Enabled" as one of the vulnerabilities on the server. This is apparently
part the mod_rewrite.
One solution is to deny HTTP TRACE in mod_rewrite, which I don't know
how to do (a Google search hasn't shed any light on the matter). The
other is to take out mod_rewrite completely, which may/may not be even
more of a security problem.
Any input, anyone?
Thanks.
- Best regards,
Lee Reilly