Apache: disabling the TRACE option

The HTTP TRACE method sends back to the client the exact request it sent, in echo. Designed for debugging, it is a door for XST (Cross-Site Tracing): JavaScript on a compromised page can use TRACE to read HttpOnly cookies via the request headers. IE6 allowed it, Firefox too.

The test:

$ telnet mydomain.com 80
TRACE / HTTP/1.1
Host: mydomain.com

HTTP/1.1 200 OK
TRACE / HTTP/1.1
Host: mydomain.com
...

If you see your request echoed back, TRACE is enabled.

The fix in Apache:

TraceEnable off

One line in the VirtualHost or httpd.conf. The result: 405 Method Not Allowed.

For Apache versions that do not support TraceEnable (< 1.3.34, < 2.0.55), the solution is mod_rewrite:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

[edit: 2026] TraceEnable is the default in Apache 2.2+. XST is less relevant now that modern browsers prevent TRACE via XMLHttpRequest, but the test remains valid on older servers. The audit reflex: curl -X TRACE mydomain.com -i and check for the 405.