I blocked HEAD,TRACE in request filtering, but it keeps appearing on the allowed methods list.

Question

I blocked HEAD,TRACE in request filtering, but it keeps appearing on the allowed methods list.

It works functionally but does not disappear from the allow method. I don't know why.

Answer 1

Hello

Thank you for your question and reaching out.

You should continue to retain a request filtering rule with the TRACE verb banned in order to effectively stop TRACE requests.

IIS receives an OPTIONS request from the curl command, and the ProtocolSupportModule creates the response message.

Sample web.config

---

<requestFiltering>

  <verbs allowUnlisted="false">

    <clear/>

    <add verb="GET" allowed="true" />

    <add verb="HEAD" allowed="true" />

    <add verb="POST" allowed="true" />

  </verbs>

</requestFiltering>

---

--If the reply is helpful, please Upvote and Accept as answer--