Could TRACE METHOD cause harm to my website?

If this request is made:

TRACE / <script>confirm("Java Script !")</script> HTTP/1.1
Host: xxxxxdomain.com
X-Wing: <script>bar()</script>

It returns a javascript confirm ( Java Script !).

What can an attacker can do with this vulnerability?

  • 1
    Please edit your question to (1) provide a more descriptive title, (2) tell us what research you've done (hint: there are other questions on this site that seem relevant).
    – D.W.
    Commented Aug 30, 2015 at 4:30

2 Answers 2


The TRACE method is not issued by browsers for normal requests, that is you would need to do an XHR request or an HTTP request from a plugin or external tool. Since script is only executed by the browser when receiving a response to a normal GET/POST request executed by the browser for links, forms, script inclusion etc but not for manually generated requests like XHR etc that means that you cannot attack a browser this way.

But there are other attacks possible with TRACE, see OWASP for more information.


May be the most serious threat that an attacker can do with TRACE is to access document.cookie property in order to hijack the victim's session. TRACE won't work in any browser (luckily).

For the case you described, it depends on the security layers implemented on the server the attacker runs it against and the question, as it is asked, is too broad to answer exactly. But put in your mind that the attacker will get information on how the server responds to a given request.

For curiosity, run this on Terminal ( www.google.com):

curl -X TRACE

You will get this error message:

Error 405 (Method Not Allowed)!!1

Not the answer you're looking for? Browse other questions tagged .