1

a web application security assessment recommends me to disable OPTIONS method on the webserver

im running Apache/2.2.22(ubuntu)

The solution i found so far was to add this certain code.

RewriteEngine on
RewriteCond %{THE_REQUEST} !^(POST|GET)\ /.*\ HTTP/1\.1$
RewriteRule .* - [F]

im quite confused where to add this specific code, i have 3 .conf on my /etc/apache2

  • apache2.conf
  • httpd.conf
  • ports.conf

do i just add the snippet anywhere inside the .conf file?


[edit]

after adding the config on my apache2.conf OR httpd.conf im getting this error when i try to restart

Invalid command 'RewriteCond', perhaps misspelled or defined by a module not included in the server configuration
Action 'configtest' failed.

The Apache error log may have more information.
   ...fail!

[edit2]

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://192.168.5.1/web/">here</a>.</p>
<hr>
<address>Apache/2.2.22 (Ubuntu) Server at 192.168.5.1 Port 80</address>
</body></html>
2
  • Are you using virtual hosts for your sites? Dec 12, 2013 at 6:47
  • no. i just access my website by 'IP/website' Dec 12, 2013 at 6:53

1 Answer 1

1

If you have configured vhosts for your site you can add inside your required vhosts. If not you can simply add to httpd.conf if not exists add to apache2.conf file.

7
  • ok, so after i add the code. how do i check if its implemented? or how do i check if the code is working? Dec 12, 2013 at 6:58
  • You can make request using curl to your website like PUT DELETE they will surely give 403 Forbidden except for POST, GET. Dec 12, 2013 at 7:01
  • hi, can you check my edit above? i seem to be getting some kind of error when i try to add the code and restart the server. Dec 12, 2013 at 7:07
  • Try to add in apache2.conf and where you have pasted the code? Please add code to the last line of document. It seems working here. Dec 12, 2013 at 7:10
  • sorry i didn't know that i need to enable rewrite first. it accepts the code. now im getting 301 Moved Permanently Dec 12, 2013 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .