By default, the HTTP TRACE request method is enabled in Apache web server.
Having this enabled can allow Cross Site Tracing attack and potentially give an option to a hacker to steal cookie information.
Disable the HTTP TRACE request method.
Edit your Apache configuration file
/etc/apache2/httpd.conf and add the following:
# Disable the HTTP TRACE request method TraceEnable off
[root@nowherelan]# systemctl reload httpd.service
Use the online Request Method Security Scanner to remotely check your site for which HTTP request methods are allowed. It should list the TRACE method as “Method Not Allowed (405).”
My System Configuration
- CentOS 7
- Apache 2.4