如何通過htaccess拒絕跟蹤請求？

我想通過htaccess禁用跟蹤和跟蹤方法。如何通過htaccess拒絕跟蹤請求？

在我的htaccess下面的代碼片段：

RewriteCond %{REQUEST_METHOD} ^TRAC[EK] 
RewriteRule .* - [L,R=405]

我得到以下答案

url -v -X TRACK obscuredurl* Adding handle: conn: 0x7f8c43004400 
* Adding handle: send: 0 
* Adding handle: recv: 0 
* Curl_addHandleToPipeline: length: 1 
* - Conn 0 (0x7f8c43004400) send_pipe: 1, recv_pipe: 0 
* About to connect() to obscuredurl port 80 (#0) 
* Trying xx.xx.xxx.xx... 
* Connected to obscuredurl (xx.xx.xxx.xx) port 80 (#0) 
> TRACK/HTTP/1.1 
> User-Agent: curl/7.30.0 
> Host: obscuredurl 
> Accept: */* 
> 
< HTTP/1.1 405 Method Not Allowed 
< Date: Tue, 14 Jan 2014 09:53:45 GMT 
* Server Apache is not blacklisted 
< Server: Apache 
< Allow: TRACE 
< Content-Length: 296 
< Connection: close 
< Content-Type: text/html; charset=iso-8859-1 
< 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> 
<html><head> 
<title>405 Method Not Allowed</title> 
</head><body> 
<h1>Method Not Allowed</h1> 
<p>The requested method TRACK is not allowed for the URL /.</p> 
<hr> 
<address>Apache Server at obscuredurl Port 80</address> 
</body></html> 
* Closing connection 0

而且

curl -v -X TRACE obscuredurl 
* Adding handle: conn: 0x7ff339004400 
* Adding handle: send: 0 
* Adding handle: recv: 0 
* Curl_addHandleToPipeline: length: 1 
* - Conn 0 (0x7ff339004400) send_pipe: 1, recv_pipe: 0 
* About to connect() to obscuredurl port 80 (#0) 
* Trying xx.xx.xxx.xx... 
* Connected to obscuredurl (xx.xx.xxx.xx) port 80 (#0) 
> TRACE/HTTP/1.1 
> User-Agent: curl/7.30.0 
> Host: obscuredurl 
> Accept: */* 
> 
< HTTP/1.1 200 OK 
< Date: Tue, 14 Jan 2014 09:55:15 GMT 
* Server Apache is not blacklisted 
< Server: Apache 
< Connection: close 
< Transfer-Encoding: chunked 
< Content-Type: message/http 
< 
TRACE/HTTP/1.1 
User-Agent: curl/7.30.0 
Host: obscuredurl 
Accept: */* 

* Closing connection 0

因此，似乎與TRACK工作，但不與跟蹤。兩個分離的條件也適用。

我該如何調試？

由於

來源

2014-01-14 noeden

要回答實際問題：通過啓用「RewriteLog」並提高日誌級別來調試重寫規則。你也可以把'TraceEnable off'放在全局'httpd.conf'中。 –

[本主題暗示你的方法應該可以正常工作]（http://superuser.com/q/655446）。 –

我無法修改此服務器上的httpd.conf。這不是我的。 httpd.conf中的'traceEnable On'是否可能否決htaccess？ – noeden

差在Apache的處理的TRACE和TRACK請求方法。當你注意到TRACK請求被mod_rewrite規則在Apache中適當處理，但TRACE被Apache處理在更高的層次甚至讀你.htacess之前，您可以驗證通過把一些垃圾文字.htaccess，然後調用TRACE請求獲得適當的反應，而不是預期的500 (Internal Server Error)。

您可能需要請求服務器管理員在Apache服務器的配置加上這一句：

TraceEnable Off

關掉TRACE。

來源

2014-01-14 20:33:11 anubhava

如何通過htaccess拒絕跟蹤請求？

回答

相關問題