[SENTRY-2068] Disable HTTP TRACE method from the Sentry Web Server

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.8.0
• Fix Version/s: 2.0.0
• Component/s: Sentry
• Assignee: Sergio Peña
• Reporter: Sergio Peña
• Created: 21/Nov/17 20:43
• Updated: 22/Nov/17 21:19
• Resolved: 22/Nov/17 21:19

Description

The HTTP TRACE method is normally used to return the full HTTP request back to the requesting client for proxy-debugging purposes. An attacker can create a webpage using XMLHTTP, ActiveX, or XMLDOM to cause a client to issue a TRACE request and capture the client's cookies. This effectively results in a Cross-Site Scripting attack.

We should disable the HTTP TRACE method from the Web Server.

Issue Links

• links to: Review Board