Here I am new to insecure HTTP Methods Enabled.

The server allows HTTP methods that are considered dangerous. The following methods were enabled: PUT,DELETE

Software used: Apache-tomcat-6.0.29.

  1. How to reproduce the same?
  2. How to fix this problem/issue?
  • May have a look at: stackoverflow.com/questions/320959/… or for whitelist: serverfault.com/questions/662548/…
    – Danny.
    Jun 18, 2015 at 6:23
  • how to reproduce this HTTP Methods Enabled or not. @danny Jun 18, 2015 at 6:58
  • 2
    What do you want to reproduce? Do you want to test the HTTP Methods? Then simply create an HTTP Request (Tools on internet or have a look at the posted questions). Would be great if you show a bit more effort (Improve Quality of your question, make clear what you want). Otherwhise the community will not give you enough attention.
    – Danny.
    Jun 18, 2015 at 7:00
  • 1
    In case you use (FULL) REST API's, the PUT and DELETE methods should be enabled. It's recommended to only have these method enabled at a specific endpoint such as http://..../api/
    – Jeroen
    Jun 18, 2015 at 10:42

1 Answer 1

  1. How to reproduce the same?

There are multiple answers on this site for exactly that question. Typing HTTP method into the Search box pulls up:

  1. How to fix this problem issue?

Under Tomcat, you can disable specific methods via the web.xml configuration file:

  <web-resource-name><strong>restricted methods</strong></web-resource-name>
 <auth-constraint />

As @Danny points out in the comments, you may want a whitelist rather than a blacklist, and here's a Tomcat 7 example. Here's an alternative for Tomcat 6.

That being said, a blacklist is often sufficient for HTTP methods because:

  • There's a reasonably static/unchanging list of what's supported,
  • Unsupported methods are generally quietly dropped by any competent web server

That said, if the report of Tomcat being case sensitive is true, a whitelist would be the appropriate way to compensate for crappy software.

  • 1
    Well, from Security point of view he should do "whitelisting" not "blacklisting". Disable everything and only allows "accepted" methods like: serverfault.com/questions/662548/… .
    – Danny.
    Jun 18, 2015 at 10:38

Not the answer you're looking for? Browse other questions tagged .