如何通过htaccess拒绝跟踪请求？

我想通过htaccess禁用跟踪和跟踪方法。如何通过htaccess拒绝跟踪请求？

在我的htaccess下面的代码片段：

RewriteCond %{REQUEST_METHOD} ^TRAC[EK] 
RewriteRule .* - [L,R=405]

我得到以下答案

url -v -X TRACK obscuredurl* Adding handle: conn: 0x7f8c43004400 
* Adding handle: send: 0 
* Adding handle: recv: 0 
* Curl_addHandleToPipeline: length: 1 
* - Conn 0 (0x7f8c43004400) send_pipe: 1, recv_pipe: 0 
* About to connect() to obscuredurl port 80 (#0) 
* Trying xx.xx.xxx.xx... 
* Connected to obscuredurl (xx.xx.xxx.xx) port 80 (#0) 
> TRACK/HTTP/1.1 
> User-Agent: curl/7.30.0 
> Host: obscuredurl 
> Accept: */* 
> 
< HTTP/1.1 405 Method Not Allowed 
< Date: Tue, 14 Jan 2014 09:53:45 GMT 
* Server Apache is not blacklisted 
< Server: Apache 
< Allow: TRACE 
< Content-Length: 296 
< Connection: close 
< Content-Type: text/html; charset=iso-8859-1 
< 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> 
<html><head> 
<title>405 Method Not Allowed</title> 
</head><body> 
<h1>Method Not Allowed</h1> 
<p>The requested method TRACK is not allowed for the URL /.</p> 
<hr> 
<address>Apache Server at obscuredurl Port 80</address> 
</body></html> 
* Closing connection 0

而且

curl -v -X TRACE obscuredurl 
* Adding handle: conn: 0x7ff339004400 
* Adding handle: send: 0 
* Adding handle: recv: 0 
* Curl_addHandleToPipeline: length: 1 
* - Conn 0 (0x7ff339004400) send_pipe: 1, recv_pipe: 0 
* About to connect() to obscuredurl port 80 (#0) 
* Trying xx.xx.xxx.xx... 
* Connected to obscuredurl (xx.xx.xxx.xx) port 80 (#0) 
> TRACE/HTTP/1.1 
> User-Agent: curl/7.30.0 
> Host: obscuredurl 
> Accept: */* 
> 
< HTTP/1.1 200 OK 
< Date: Tue, 14 Jan 2014 09:55:15 GMT 
* Server Apache is not blacklisted 
< Server: Apache 
< Connection: close 
< Transfer-Encoding: chunked 
< Content-Type: message/http 
< 
TRACE/HTTP/1.1 
User-Agent: curl/7.30.0 
Host: obscuredurl 
Accept: */* 

* Closing connection 0

因此，似乎与TRACK工作，但不与跟踪。两个分离的条件也适用。

我该如何调试？

由于

来源

2014-01-14 noeden

要回答实际问题：通过启用“RewriteLog”并提高日志级别来调试重写规则。你也可以把'TraceEnable off'放在全局'httpd.conf'中。 –

[本主题暗示你的方法应该可以正常工作]（http://superuser.com/q/655446）。 –

我无法修改此服务器上的httpd.conf。这不是我的。 httpd.conf中的'traceEnable On'是否可能否决htaccess？ – noeden

差在Apache的处理的TRACE和TRACK请求方法。当你注意到TRACK请求被mod_rewrite规则在Apache中适当处理，但TRACE被Apache处理在更高的层次甚至读你.htacess之前，您可以验证通过把一些垃圾文字.htaccess，然后调用TRACE请求获得适当的反应，而不是预期的500 (Internal Server Error)。

您可能需要请求服务器管理员在Apache服务器的配置加上这一句：

TraceEnable Off

关掉TRACE。

来源

2014-01-14 20:33:11 anubhava

如何通过htaccess拒绝跟踪请求？

回答

相关问题