Skip to content

IBX-2921: Disable TRACE/TRACK #683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
glye wants to merge 2 commits into
base: 2.5
Choose a base branch
from
Open

IBX-2921: Disable TRACE/TRACK #683

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
abf7201
IBX-2921: Disabled TRACE/TRACK in Apache/Nginx
vidarl Jul 13, 2022
a43195d
Case insensitive matching. Added doc for Nginx.
glye Jul 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions doc/apache2/vhost.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,10 @@
<IfModule mod_rewrite.c>
RewriteEngine On

# Make sure TRACE and TRACK methods are denied
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) [NC]
RewriteRule .* - [F]

# For FastCGI mode or when using PHP-FPM, to get basic auth working.
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

Expand Down
5 changes: 5 additions & 0 deletions doc/nginx/vhost.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ server {

root %BASEDIR%/web;

# Make sure TRACE and TRACK methods are denied
if ($request_method ~* ^(TRACE|TRACK)$) {
return 405;
}

# Additional Assetic rules
## Don't forget to run php bin/console assetic:dump --env=prod
## and make sure to comment these out in DEV environment.
Expand Down