What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?


1 Answer 1


Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response.

This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set.

The HTTP TRACE method is used for debugging purposes only and should be disabled.

Apache Configuration:

TraceEnable off

IIS Registry Setting:

EnableTraceMethod: 0

Not the answer you're looking for? Browse other questions tagged .