HTTP TRACE method

Whether the server answers TRACE by echoing the request back. Nothing needs the method, and a script tricked into sending one reads the cookies the browser attached.

• Help center

TRACE is an HTTP method for debugging: the server sends the received request straight back in the response body, headers and all. Nothing in a normal website needs it. The risk is known as cross-site tracing: if a script manages to send a TRACE request, the echo contains the cookies and the Authorization header the browser attached — including cookies marked HttpOnly, which scripts are otherwise not allowed to read. Modern browsers block TRACE from scripts, but proxies, plugins and other clients do not always, and the open method also tells scanners the server's configuration has not been reviewed.

How SiteScan checks it

The scanner sends one TRACE request to the home page. If the server answers 200 with the message/http content type — a real echo — the row shows “Answers” in red. Any other answer, such as 405 Method Not Allowed, is “Refused” and green.

How to turn it off

• Apache: TraceEnable off in the main configuration.
• nginx does not support TRACE and refuses it by default; if it answers, the echo comes from a backend or proxy behind it.
• IIS: in Request Filtering, deny the TRACE verb.
• On a CDN or load balancer, block methods other than GET, HEAD, POST and those your API needs.

More hardening steps are on the security headers page.