users@glassfish.java.net

Re: How to disable HTTP TRACE on Sun-ONE-Application-Server/7.0.0_01?

From: <glassfish_at_javadesktop.org>
Date: Fri, 23 Jan 2009 04:31:42 PST

The method for disabling TRACE requests works by changing the content-length of the TRACE request that's been received into an invalid one, which appears to result in the HTTP 413 error you are seeing.

Ideally you'd like to see a 501 Not Implemented, but the 413 is probably a consequence of the web/http engine that AS 7.x uses not honouring/accepting the error definition in that directive.

In any case, the HTTP Trace request is blocked and not processed, closing that security vulnerability.

If you have a support contract you can view this:

http://sunsolve.sun.com/search/document.do?assetkey=1-9-70245-1

While this is for WS 4.1/6.0, AS 7.x borrows the web server's code for its http engine, so if a 413 is expected for that product, it is likewise expected for AS 7.x.
[Message sent by forum member 'tecknobabble' (tecknobabble)]

http://forums.java.net/jive/thread.jspa?messageID=327791