0

Hi so our security team said that we need to hide the Allow header

Is the request possible?

Improve this question
3
  • Those are standards http methods, hiding them will not prevent malicious requests to try them.
    – elsadek
    Feb 1, 2019 at 6:54
  • i know but what the security team said is that to make the website pass this test we should've atleast hide the "Allow" because the main reason is to block the HTTP verbs but we cant do that because Sharepoint is using it. Is there something i could say to them to convince them?
    – Beenee
    Feb 1, 2019 at 7:03
  • 1
    Welcome. It would be beneficial to your question if you pasted the actual textual content you wanted to show instead of a screenshot. Image links go dead or break - which would make your question unintelligible - and this is not very mobile friendly.
    – Tobi Nary
    Feb 1, 2019 at 7:44

1 Answer 1

Reset to default
2

... our security team said that we need to hide the Allow header

Either they've told you something wrong or you understood it wrong. Allow is actually a mandatory header when doing response code 405. From RFC 7231 section 6.5.5:

405 Method Not Allowed
The 405 (Method Not Allowed) status code indicates that the method received in the request-line is known by the origin server but not supported by the target resource. The origin server MUST generate an Allow header field in a 405 response containing a list of the target resource's currently supported methods.

What I find a more likely requirement given the picture you show is that the server should not support the TRACE method in the first place and therefore also should not show TRACE as supported.

Improve this answer
3
  • Actually what you've said was the real requirements but it is used by the system so therefore we couldn't remove it, then what they've requested is that we should at least hide(The Allow Headed on 405) it. So basically the one who told us to hide it doesn't know that it is a mandatory header correct?
    – Beenee
    Feb 1, 2019 at 7:20
  • 1
    @Beenee: Likely they did not know that Allow is mandatory since deeper knowledge of the internet protocols is not very common. My guess is that they just wanted to have some automatic tool no longer report that the server is supporting TRACE in order to pass the security checks done by this tool. Still, just hiding the information from Allow will not help much since this knowledge can be easily gained by just trying the method.
    – Steffen Ullrich
    Feb 1, 2019 at 7:30
  • 100% this. I would flag up the TRACE method in a pentest and my recommendation would be to disable it, albeit as a low/informational rated issue. The Allow response header just highlights the problem that it exposes which options are supported on the page, which can be occasionally (but rarely) useful for finding hidden functionality.
    – Polynomial
    Feb 18, 2019 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .