How to disable dangerous http methods, such as TRACE, OPTIONS.

windows 2008-2012:

Please create web.config in the wwwroot directory with the following content. If the file already exists, please add the red part.

<?xml version="1.0" encoding="UTF-8"?>

<configuration>

<system.webServer>

    <security>

      <requestFiltering>

        <verbs allowUnlisted="true">

          <add verb="OPTIONS" allowed="false"/>

          <add verb="TRACE" allowed="false"/>

        </verbs>

      </requestFiltering>

    </security>

</system.webServer>

</configuration>

windows 2003:

Control Panel - ISAPI Filters - Enable custom rewrite component, then edit /others/discuz/httpd.conf. If you already have other rules, please add them as the first rule.

RewriteEngine on

RewriteCond %{THE_REQUEST} ^(TRACE|OPTIONS)

RewriteRule .* - [F]

linux:

Create a .htaccess file in the wwwroot directory with the following content. If you already have other rules, please add them as the first rule.

RewriteEngine On

RewriteCond %{REQUEST_METHOD} ^(TRACE|OPTIONS)

RewriteRule .* - [F]