This question already has an answer here:
What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?
-2
marked as duplicate by Lucas Kauffman, Mark, Stephane, AviD♦ Dec 9 '14 at 9:29
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
-
Duplicated: security.stackexchange.com/questions/56955/…, security.stackexchange.com/questions/7703/…, security.stackexchange.com/questions/16676/… – kinunt Dec 9 '14 at 6:11
-
Please refrain from asking anymore questions as long as you have not read our FaQ and help pages. – Lucas Kauffman Dec 9 '14 at 7:21
1
Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response.
This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set.
The HTTP TRACE method is used for debugging purposes only and should be disabled.
Apache Configuration:
TraceEnable off
IIS Registry Setting:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
EnableTraceMethod: 0
