Re: allowTrace="false" allowing Trace Method

2010-01-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Iain, On 1/14/2010 6:16 AM, iainmac wrote: > Sorry, not sure what you want an example of, and not sure what you mean when > you ask what connectors I am using (not really an expert) I meant the elements specified in conf/server.xml. Just post them a

Re: allowTrace="false" allowing Trace Method

2010-01-14 Thread Pid
On 14/01/2010 11:16, iainmac wrote: Sorry, not sure what you want an example of, and not sure what you mean when you ask what connectors I am using (not really an expert) The Connectors are defined in the server.xml file. Either HTTP or AJP, it should be clear which. Using Tomcat 5.0.16.

Re: allowTrace="false" allowing Trace Method

2010-01-14 Thread iainmac
Sorry, not sure what you want an example of, and not sure what you mean when you ask what connectors I am using (not really an expert) Using Tomcat 5.0.16. My workaround did pass the security scan. Strangely I had the same version of Tomcat on a different box where the allowTrace="false" did wh

Re: allowTrace="false" allowing Trace Method

2010-01-13 Thread Konstantin Kolinko
2010/1/13 iainmac : > > Hi, > > I need to disable TRACE to pass a security scan, so I added > allowTrace="false" to all my connectors, but its still allowing TRACE! > > I had to work around with urlrewrite and a jsp with 1 line which was > response.sendError(response.SC_NOT_IMPLEMENTED , "NOT IMPLE

Re: allowTrace="false" allowing Trace Method

2010-01-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ian, On 1/13/2010 12:37 PM, iainmac wrote: > I need to disable TRACE to pass a security scan, so I added > allowTrace="false" to all my connectors, but its still allowing TRACE! Can you give us an example? Recently, someone complained that the JSPSe

allowTrace="false" allowing Trace Method

2010-01-13 Thread iainmac
Hi, I need to disable TRACE to pass a security scan, so I added allowTrace="false" to all my connectors, but its still allowing TRACE! I had to work around with urlrewrite and a jsp with 1 line which was response.sendError(response.SC_NOT_IMPLEMENTED , "NOT IMPLEMENTED"); However I would prefer