mod_rewrite - deny HTTP TRACE

From: Date: Thu, 17 Apr 2003 15:39:16 +0000
Subject: mod_rewrite - deny HTTP TRACE
Groups: php.general 
Request: Send a blank email to php-general+get-144306@lists.php.net to get a copy of this message
Hi there, All of my PHP installations use the mod_rewrite module, which is enabled when I build Apache. What effect would it have on PHP if I were to remove this module? I'm getting ready to open my production server to the world, and my company's security scan listed "HTTP TRACE Method Enabled" as one of the vulnerabilities on the server. This is apparently part the mod_rewrite. One solution is to deny HTTP TRACE in mod_rewrite, which I don't know how to do (a Google search hasn't shed any light on the matter). The other is to take out mod_rewrite completely, which may/may not be even more of a security problem. Any input, anyone? Thanks. - Best regards, Lee Reilly

« previous php.general (#144306) next »