0

Hi so our security team said that we need to hide the Allow header

Is the request possible?

  • Those are standards http methods, hiding them will not prevent malicious requests to try them. – elsadek Feb 1 at 6:54
  • i know but what the security team said is that to make the website pass this test we should've atleast hide the "Allow" because the main reason is to block the HTTP verbs but we cant do that because Sharepoint is using it. Is there something i could say to them to convince them? – Beenee Feb 1 at 7:03
  • 1
    Welcome. It would be beneficial to your question if you pasted the actual textual content you wanted to show instead of a screenshot. Image links go dead or break - which would make your question unintelligible - and this is not very mobile friendly. – Tobi Nary Feb 1 at 7:44
2

... our security team said that we need to hide the Allow header

Either they've told you something wrong or you understood it wrong. Allow is actually a mandatory header when doing response code 405. From RFC 7231 section 6.5.5:

405 Method Not Allowed
The 405 (Method Not Allowed) status code indicates that the method received in the request-line is known by the origin server but not supported by the target resource. The origin server MUST generate an Allow header field in a 405 response containing a list of the target resource's currently supported methods.

What I find a more likely requirement given the picture you show is that the server should not support the TRACE method in the first place and therefore also should not show TRACE as supported.

  • Actually what you've said was the real requirements but it is used by the system so therefore we couldn't remove it, then what they've requested is that we should at least hide(The Allow Headed on 405) it. So basically the one who told us to hide it doesn't know that it is a mandatory header correct? – Beenee Feb 1 at 7:20
  • 1
    @Beenee: Likely they did not know that Allow is mandatory since deeper knowledge of the internet protocols is not very common. My guess is that they just wanted to have some automatic tool no longer report that the server is supporting TRACE in order to pass the security checks done by this tool. Still, just hiding the information from Allow will not help much since this knowledge can be easily gained by just trying the method. – Steffen Ullrich Feb 1 at 7:30
  • 100% this. I would flag up the TRACE method in a pentest and my recommendation would be to disable it, albeit as a low/informational rated issue. The Allow response header just highlights the problem that it exposes which options are supported on the page, which can be occasionally (but rarely) useful for finding hidden functionality. – Polynomial Feb 18 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.