a web application security assessment recommends me to disable OPTIONS method on the webserver
im running Apache/2.2.22(ubuntu)
The solution i found so far was to add this certain code.
RewriteEngine on
RewriteCond %{THE_REQUEST} !^(POST|GET)\ /.*\ HTTP/1\.1$
RewriteRule .* - [F]
im quite confused where to add this specific code, i have 3 .conf
on my /etc/apache2
- apache2.conf
- httpd.conf
- ports.conf
do i just add the snippet anywhere inside the .conf
file?
[edit]
after adding the config on my apache2.conf
OR httpd.conf
im getting this error when i try to restart
Invalid command 'RewriteCond', perhaps misspelled or defined by a module not included in the server configuration
Action 'configtest' failed.
The Apache error log may have more information.
...fail!
[edit2]
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://192.168.5.1/web/">here</a>.</p>
<hr>
<address>Apache/2.2.22 (Ubuntu) Server at 192.168.5.1 Port 80</address>
</body></html>
virtual hosts
for your sites?