HTTP Trace Method in Access Gateway
smsps configuration wizard provides the option to either enable or disable HTTP Trace method at smsps.
Access Gatewayconfiguration wizard provides the option to either enable or disable HTTP Trace method at
Default Behavior of Access Gateway
Access Gatewayreturns HTTP Method 405 when the
TraceFlagis either on or off as it does not load mod_proxy or mod_rewrite modules which act on HTTP Trace method.
Access Gatewayreturns the following HTTP response code:
405 Method Not Allowed
Apache HTTP Server Behavior
Access Gatewayinternally uses Apache HTTPD Server for request processing. Behavior of the Apache Web Server for a specific HTTP Trace method depends on the modules loaded. Each module loaded into Apache requires the Hook Parameter which decides the precedence of receiving the request. If the Hook parameter is of the same order for two different modules, then the order of modules placed in the httpd.conf takes precedence.
SiteMinderWeb Agent module for Apache also gets loaded under the context of httpd server and controls actions such as showing page (http method 200), redirecting (http method 302), challenging the user (http method 401), and server error for XSS attacks (http method 500). Access Gateway not only ships all the modules but also loads only a minimum set and allows customization to load other modules in httpd.conf.
Working with HTTP Trace Method in
To allow HTTP Trace method in access gateway, follow the process below:
Follow these steps:
- Navigate to secure-proxy\httpd\conf\ and open httpd.conf file.
Testing Trace Method
Check for the output with the following trace flows:
- When you test Trace method using curl or any other tool with proxy_module and TraceEnable on in httpd.conf file, you receive the following HTTP response output:200 OK
- When you test Trace method using curl or any other tool with proxy_module and TraceEnable off in httpd.conf file, you receive the following HTTP response output:405 OK