Hi so our security team said that we need to hide the Allow header
Is the request possible?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community... our security team said that we need to hide the Allow header
Either they've told you something wrong or you understood it wrong. Allow
is actually a mandatory header when doing response code 405. From RFC 7231 section 6.5.5:
405 Method Not Allowed
The 405 (Method Not Allowed) status code indicates that the method received in the request-line is known by the origin server but not supported by the target resource. The origin server MUST generate an Allow header field in a 405 response containing a list of the target resource's currently supported methods.
What I find a more likely requirement given the picture you show is that the server should not support the TRACE method in the first place and therefore also should not show TRACE as supported.
Allow
response header just highlights the problem that it exposes which options are supported on the page, which can be occasionally (but rarely) useful for finding hidden functionality.
Feb 18, 2019 at 19:46