This question already has an answer here:

What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?

marked as duplicate by Lucas Kauffman, Mark, Stephane, AviD Dec 9 '14 at 9:29

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response.

This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set.

The HTTP TRACE method is used for debugging purposes only and should be disabled.

Apache Configuration:

TraceEnable off

IIS Registry Setting:

EnableTraceMethod: 0

Not the answer you're looking for? Browse other questions tagged or ask your own question.