Apache TraceEnable Off (#4863) · b835c426d4 - Gogs

Apache TraceEnable Off (#4863)

I have just received an e-mail with a security concern.
Although most likely an obsolete concern (old browsers with Java applets), and the Apache team saying that there is no problem, let's disable the TRACE method by default in our Docker images until we hear anybody actually wanting this feature.
https://httpd.apache.org/docs/current/mod/core.html#traceenable
https://owasp.org/www-community/attacks/Cross_Site_Tracing

Alexandre Alapetite 3 years ago

parent

5035dadfdd

commit

b835c426d4

1 changed files with 1 additions and 0 deletions

Split View Show Diff Stats

						
							+ 1
							
							- 0
						
Docker/FreshRSS.Apache.conf
							 
								View File
							
				@@ -8,6 +8,7 @@ CustomLog /dev/stdout combined_proxy
			
				 ErrorLog /dev/stderr
			
				 AllowEncodedSlashes On
			
				 ServerTokens OS
			
				+TraceEnable Off
			
				 <Directory />
			
				 	AllowOverride None