Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Most security advice I see recommends turning off HTTP Methods like TRACE, OPTIONS, HEAD etc. So now I have turned off most of these options on my web server and leaving only GET and POST options that can be returned. The question is, now some my applications are using HEAD and some users are hitting errors doing stuff in the application. Checking the logs revealed some HEAD requests coming from the user end. I am suspecting that it's because my server has stopped responding to HEAD so the connection has dropped. My question is, is HEAD really that not safe as I read that it also has it's legitimate uses? or should I just tell my application developers/project manager to change their code? thanks.

share|improve this question
9  
It's worth noting that the HTTP spec (RFC 2616) states that: "The methods GET and HEAD MUST be supported by all general-purpose servers. All other methods are OPTIONAL" So you may wish to weigh the supposed security benefits of turning off HEAD against the possible problems created by not following the HTTP spec. – Ajedi32 Jan 25 at 20:52
    
Very good answer here already, so I won't mark it as duplicate, however you might find this interesting too: security.stackexchange.com/q/21413/33 – AviD Jan 26 at 0:38
2  
You probably never need TRACE on a public site. You may need OPTIONS on a REST API (for CORS). You need DELETE, PUT, PATCH on a REST API. HEAD is useful in a REST API to see if a resource exists – Neil McGuigan Jan 26 at 1:09
up vote 31 down vote accepted

HEAD is not dangerous in itself, and it does have legitimate uses. The problem is with Java EE. It has a way to set security constraints using web.xml files - but those are only applied to GET and POST, not to HEAD. This means that it is can be possible to bypass authentication using HEAD. There is more information about this and other issues in this paper on penetration testing by the SANS Institute.

Whether this particular issue is applicable to your application will obviously depend on what application server and other security measures you are using.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.