What is HTTP OPTIONS Method

Reply
Highlighted
L3 Networker

What is HTTP OPTIONS Method

Hi,

In our ACC I can see that the status bar is 3.7, thanks to the vulnerability HTTP OPTIONS Method. The problem is that I have no idea what this is and how I can fix this.
How can I fix this problem?

Not applicable

Re: What is HTTP OPTIONS Method

OPTIONS Method

The OPTIONS method is used by the client to find out what are the HTTP methods and other options supported by a web server. The client can specify a URL for the OPTIONS method, or an asterisk (*) to refer to the entire server. The following example request a list of methods supported by a web server running on tutorialspoint.com:

OPTIONS * HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT) 

HTTP Methods

________________

How to fix the issue:

From what I have researched, I believe you can only configure your web servers to not allow this method. There is nothing on the firewall that can be done.

L7 Applicator

Re: What is HTTP OPTIONS Method

As Dave mentioned, you would need to turn this off on the web server.

With Microsoft IIS you would use user request filtering to remove the options keyword.

Use Request Filtering : The Official Microsoft IIS Site

You may also be interesting in the MS Technet article on hardening production IIS servers and the lockdown tool.

Security Guidance for IIS

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
L6 Presenter

Re: What is HTTP OPTIONS Method

Good one Steven ....

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!