Topic: blocking trace with mod_rewrite

[ali_fareed]

hello everybody, I am using mod_rewrite to block trace requests by adding this code to the configuration:
<IfModule rewrite_module>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* – [F]
</IfModule>
and it seems to work fine but when I tried connecting with ssl using openssl s_client I was able to get a trace response is there something missing in my configuration or is there a problem with mod_rewrite and I'm really sorry for asking so many questions.

[Steffen]

There no known issues with mod_rewrite.

Do not know openssl s_client, but it should block the Trace REQUEST_METHOD, maybe you are talking about a different trace in s_client.

We use the rule:

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule ^ - [F]


Steffen

[ali_fareed]

You dont know the s_client in openssl? it's an ssl client in openssl which gives you the ability to send raw request to any type of servers like using netcat or telnet but for ssl you can use it by invoking openssl with "openssl s_client -connect server:port" and I mean the trace method the one where you make a request and get a reply with you request echoed. But i'm still having a problem can anybody help me. one more thing i forgot to mention when i connect without ssl the trace request is responded with a forbidden so it's working if the request is made without ssl

[Steffen]

When you use vhosts (most of us have SSL in a vhost) then you must have in the Vhost container:
RewriteEngine on
RewriteOptions inherit

OR place the rewrite code in the Vhost container.

[ali_fareed]

no I still seem to have the problem.

[ali_fareed]

I finally got it thanks for the help.

[Steffen]

What was causing your issue ?

[ali_fareed]

like you said i had to add :
RewriteEngine on
RewriteOptions inherit

in the virtual host container in the httpd-ssl.conf file thanks for your help again.

[ali_fareed]

speaking of trace why dont you block trace no one really uses it because it's used for debugging and its a security risk because it may be used for XSS or credential theft http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf

[Steffen]

Thanks for the info.

I agrre, but I rather do not want to change the official code.

I think we must advice Apacherians not to allow the REQUEST_METHOD Trace, this can be done like you with mod_rewrite or with mod_security.


Steffen