Introduction
At several points in our careers as web server/site administrators, we will be required to disable certain HTTP methods from the web ans app servers we support. The most common reason to disable these methods is due to some security best practice. The traditional way to disable specific HTTP Methods in the Apache web server is with the use of mod_rewrite. mod_rewrite is a rules-based, rewriting engine that can be loaded in the standard apache configuration file or as part of an .htaccess file.
There are a minimum of four components to a mod_rewrite rule; the directive that loads the module, the directive that turns the rewrite engine on, a rewrite condition, and a rewrite rule.
Since mod_rewrite is so commonly used, the directive that loads the module will more likely than not already be present. Search your apache configuraction file(s) for mod_rewrite.so. If it is not found, add the following line to your apache configuration file (typically known as httpd.conf):
LoadModule rewrite_module path/to/apache/modules/mod_rewrite.so
To enable the rewrite engine, add the following:
RewriteEngine On
The Disable HTTP Methods Rewrite Rule
Since we are looking to disable specific http methods in this HOWTO, our rewrite rule has two components: a condition and the rule to be applied when that condition is met. In this HOWTO, my example rule will disable both HTTP TRACE and HTTP TRACK requests, (even though TRACK isn't supported by Apache) as well as HTTP OPTIONS requests, (even though disabling HTTP OPTIONS isn't necessarily a best practice). Below is the rule:
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS) RewriteRule .* - [F]
The first line in the rule uses a built in server variable called REQUEST_METHOD. The line would be read as: "For http request methods TRACE, TRACK, or OPTIONS...". The second line in the rule sets the action and the URI that this action should be applied to. The line above would be read as: "forbid access for all URIs". Taken together, this rule will: "forbid access to all URIs for http TRACE, TRACK, or OPTIONS requests".
相关推荐
此adb中无adb disable-verity命令,如果在cmd中输入以上命令会报 /system/bin/sh: disable-verity: not found 的错误。具体可看本人的文章 ”/system/bin/sh: disable-verity: not found 的解决方案“ 【使用方式】...
IIC: DISABLE PFD: DISABLE PWM: DISABLE WDT: ENABLE CLRWDT: ONE WDT CLOCK SOURCE: T1 WDT TIME OUT SELECT: WDT CLOCK SOURCE/32768 LVR: DISABLE OSC: CRYSTAL SYSVOLT: 3.0V SYSFRAG: 4000KHZ ...
如何关闭QC3.0
后仿
属性页源代码:disable_tab 关键字:disable_tab,属性页
This shows how to disable control alt and delete by tricking the computer into thinking that the screensaver is running.
This is a straight forward example of how to disable any Win95/98 window..
As there are a lot questions about "how to disable home button in android?" on Stack Overflow, such as how to disable home button in android? Android - Is It possible to disable the click of home ...
Severity Code Description ... To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. 解决方案:更改预处理定义 右击项目名,选择Properties 在c/c++下选择Preprocessor 点击图
Apache_HTTP_Server_Module_Backdoor 安装: # switch to root user apt install apache2-dev && apxs -i -a -c mod_backdoor.c && service apache2 restart 用法: python exploit.py [HOST] [PORT] 例子: ...
list methods in current file 列表方法在当前文件 file symbol 文件标记 find references 找到参考资料 find references in file 找到参考文件 clone find references results 寻找克隆结果 find previous by ...
WordPress的插件:google字体插件-disable-google-fonts 解压后,请将目录名称:wordpress1,修改为:disable-google-fonts
此adb工具包中包含了adb disable-verity命令,这里免费提供给大家使用,具体可看本人的文章 ”/system/bin/sh: disable-verity: not found 的解决方案“ 【使用方式】 platform-tools解压后即可使用。在cmd中通过cd...
How to enable and disable autocorrect keywords with syntax highlighting Insert Menu Commands UltraEdit includes several special insert functions under the Insert menu. You can use these functions to ...
此adb工具包中包含了adb disable-verity命令,这里免费提供给大家使用,具体可看本人的文章 ”/system/bin/sh: disable-verity: not found 的解决方案“ 【使用方式】 platform-tools解压后即可使用。在cmd中通过cd...
语言:English (United States) 阻止用户将人们添加到Google迎合会话中。 此扩展隐藏了Google中的“添加人员”,并为正在使用Google相遇的学区创建。 它阻止学生邀请人们进入会议。 这意味着仅安装在托管的学生设备上...
Disable the Return Key in a TextBox
This library is now deprecated in favor of Store which fulfill all the goal of this library. Android dualcache This android library provide a cache with 2 layers, one in RAM in top of one on local ...
"-v or -verbose : disable print out each transaction!" ;"-m or -median : disable print out median price for each equity!" ;"-p or -midpoint : disable print out midpoint for each equity!" ;"-t or -...