-
1. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
what do you mean by HTTP trace?
access logging?
request dumping?
something else?
-
2. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
I mean "HTTP Track / Trace", these are the only details I have.
A customer of ours ran a Windows Server PCI compliance scan for an audit using a product called SecurityMetrics PCI Scan and these were the results:
Description: HTTP TRACE / TRACK Methods Allowed
Synopsis: Debugging functions are enabled on the remote web server.
Impact: The remote web server supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods that are used to debug web server connections.If there are separate instructions for disabling this in access logging / request dumping / something else do you have any instructions?
Thanks
-
3. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
ah, now i manage to decrypt what you need
you will need to edit your application's web.xml file
to list only allowed http methods.
you probably need something likethis
<security-constraint>
<web-resource-collection>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<!-- no auth-constraint tag here -->
</security-constraint>see Understanding Web Security Using web.xml Via Use Cases | Javalobby and http://stackoverflow.com/questions/8069640/whitelist-security-constraint-in-web-xml
for more
-
4. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
Thanks Tomaz, I'll see if that works
-
5. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
Hi Tomaz, my customer has sent in a screenshot of their web.xml file, can you confirm what needs to be changed / added? Thank you
-
6. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
that looks fine if you want to have POST & GET only available for /restricted/* urls.
if you need it for whole application then than url-pattern should be /*
-
7. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
Hi Tomaz, sorry for the slow reply.
Can I just confirm that if the URL Pattern is changed to "/*" that this will disable HTTP track / trace?
Thanks
-
8. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
In JBoss 5.1 I was able to globally forbid some http methods in JBOSS/server/default/deployers/jbossweb.deployer/web.xml :
Is it possible in WildFly, or I need to update a lot of web.xml in my apps?
-
9. Re: Disable HTTP TRACE / TRACK in Wildfly for a Windows server
support for that was added in early WF10 builds
-
