禁用跟踪/跟踪 apache答案

【问题标题】：Disable TRACK/TRACE apache禁用跟踪/跟踪 apache
【发布时间】：2015-06-08 20:33:50
【问题描述】：

我有一个关于 TRACK/TRACE HTTP 方法的问题。我使用 TraceEnable Off 从 httpd.conf 禁用了 TRACE。当我尝试测试它是否真的被禁用时，这就是我得到的：

< HTTP/1.1 405 Method Not Allowed

但是，仍会返回完整的代码。这是正常的吗？当我在 google 网站上测试 TRACE 方法时，我得到一个包含 405 Method not Allowed 的 html。

我在这台服务器上运行 2 个站点，Apache 和 Nginx 反向代理。一个有 SSL，一个没有。

在标头响应和 HTML 代码中，非 SSL 返回 405 Method Not Allowed。

SSL 之一，在标头响应中返回 405，但带有完整的 html 代码（主页）

任何帮助将不胜感激。

谢谢！

编辑：非 SSL 的响应

* Connected to example.com (xx.xx.xx.xx) port 80 (#0)
> TRACE / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: example.com
> Accept: */*
> 
< HTTP/1.1 405 Not Allowed
* Server nginx admin is not blacklisted
< Server: nginx admin
< Date: Mon, 08 Jun 2015 11:26:45 GMT
< Content-Type: text/html
< Content-Length: 166
< Connection: close
< 
<html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Closing connection 0

SSL 站点的响应：

* Connected to www.example.com (xx.xx.xx.xx) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*    subject: OU=GT45927005; OU=See www.rapidssl.com/resources/cps (c)15; OU=Domain Control Validated - RapidSSL(R); CN=www.smartnation.ro
*    start date: 2015-05-03 09:14:54 GMT
*    expire date: 2016-05-05 19:37:10 GMT
*    issuer: C=US; O=GeoTrust Inc.; CN=RapidSSL SHA256 CA - G3
*    SSL certificate verify ok.
> TRACE / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: www.example.com
> Accept: */*
> 
< HTTP/1.1 405 Method Not Allowed
< Date: Mon, 08 Jun 2015 11:30:55 GMT
* Server Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 is not blacklisted
< Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< Pragma: no-cache
< X-Pingback: https://www.example.com/xmlrpc.php
< Set-Cookie: PHPSESSID=6b7fbfb366741438c07a9041452ea469; path=/
< Set-Cookie: _pmxi_session=%7C%7C%7C%7C; path=/
< Connection: close
< Transfer-Encoding: chunked
< Content-Type: text/html; charset=UTF-8
< 
<!DOCTYPE html>

<!--[if lt IE 7 ]><html class="ie ie6" lang="en"> <![endif]-->

<!--[if IE 7 ]><html class="ie ie7" lang="en"> <![endif]-->

<!--[if IE 8 ]><html class="ie ie8" lang="en"> <![endif]-->

<!--[if (gte IE 9)|!(IE)]><!--><html lang="en"> <!--<![endif]-->

<head>

    <meta charset="utf-8">

    <meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=no" />

    <meta name="apple-mobile-web-app-capable" content="yes" />

    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">

    <meta http-equiv="content-language" content="en" />
etc...

编辑 2：配置文件（httpd.conf 和 nginx）

Listen 0.0.0.0:8081
Listen [::]:8081
Listen 0.0.0.0:443
Listen [::]:443
<VirtualHost xx.xx.xx.xx:8081>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /home/account/public_html
    ServerAdmin webmaster@example.com
    UseCanonicalName Off
    #CustomLog /usr/local/apache/domlogs/example.com combined
    #CustomLog /usr/local/apache/domlogs/example.com-bytes_log "%{%s}t %I .\n%{%s}t %O ."
    ## User account # Needed for Cpanel::ApacheConf
    UserDir enabled account
    <IfModule mod_suphp.c>
        suPHP_UserGroup account account
    </IfModule>
    <IfModule !mod_disable_suexec.c>
        <IfModule !mod_ruid2.c>
            SuexecUserGroup account account
        </IfModule>
    </IfModule>
    <IfModule mod_ruid2.c>
        RMode config
        RUidGid account account
    </IfModule>
    <IfModule itk.c>
        # For more information on MPM ITK, please read:
        #   http://mpm-itk.sesse.net/
        AssignUserID account account
    </IfModule>
    ScriptAlias /cgi-bin/ /home/account/public_html/cgi-bin/


    # To customize this VirtualHost use an include file at the following location
    # Include "/usr/local/apache/conf/userdata/std/2/account/example.com/*.conf"

</VirtualHost>
<VirtualHost xx.xx.xx.xx:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /home/account/public_html
    ServerAdmin webmaster@example.com
    UseCanonicalName Off
    #CustomLog /usr/local/apache/domlogs/example.com combined
    #CustomLog /usr/local/apache/domlogs/example.com-bytes_log "%{%s}t %I .\n%{%s}t %O ."
    ## User natsmart # Needed for Cpanel::ApacheConf
    UserDir enabled account
    <IfModule mod_suphp.c>
        suPHP_UserGroup account account
    </IfModule>
    <IfModule !mod_disable_suexec.c>
        <IfModule !mod_ruid2.c>
            SuexecUserGroup account account
        </IfModule>
    </IfModule>
    <IfModule mod_ruid2.c>
        RMode config
        RUidGid account account
    </IfModule>
    <IfModule itk.c>
        # For more information on MPM ITK, please read:
        #   http://mpm-itk.sesse.net/
        AssignUserID account account
    </IfModule>
    ScriptAlias /cgi-bin/ /home/account/public_html/cgi-bin/
    SSLEngine on

    SSLCertificateFile /var/cpanel/ssl/installed/certs/www_example_com_dfe76_6dcdf_1462477030_fd971317dfc02602ec168052ed2c7119.crt
    SSLCertificateKeyFile /var/cpanel/ssl/installed/keys/dfe76_6dcdf_d9471fcd7e80d319080f6db604599d49.key
    SSLCACertificateFile /var/cpanel/ssl/installed/cabundles/GeoTrust_Inc__6473a1b25f37e0f134912eb5d8d02a9c_1653082772.cabundle
    #CustomLog /usr/local/apache/domlogs/example.com-ssl_log combined
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    <Directory "/home/account/public_html/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>

    # To customize this VirtualHost use an include file at the following location
    # Include "/usr/local/apache/conf/userdata/ssl/2/account/example.com/*.conf"

</VirtualHost>

Nginx：

server {
          error_log /var/log/nginx/vhost-error_log warn;
          listen xx.xx.xx.xx:80;
          listen [::]:80;
          server_name example.com www.example.com;
          access_log /usr/local/apache/domlogs/example.com-bytes_log bytes_log;
          access_log /usr/local/apache/domlogs/example.com combined;
          root /home/account/public_html;
          #location / {
          location ~*.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso)$ {
          expires 1M;
          try_files $uri @backend;
          }
          location / {
      error_page 405 = @backend;
          add_header X-Cache "HIT from Backend";
          proxy_pass http://xx.xx.xx.xx:8081;
          include proxy.inc;
      include microcache.inc;
          }
          location @backend {
          internal;
          proxy_pass http://xx.xx.xx.xx:8081;
          include proxy.inc;
      include microcache.inc;
          }
          location ~ .*\.(php|jsp|cgi|pl|py)?$ {
          proxy_pass http://xx.xx.xx.xx:8081;
          include proxy.inc;
      include microcache.inc;
          }
          location ~ /\.ht {
          deny all;
          }
        }

【问题讨论】：

标签： apache ssl nginx

【解决方案1】：

通过 RFC 指定 TRACK/TRACE (http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html) 的行为，未定义不成功调用的行为。您遇到的正是这种 - 未定义的行为。

如果通过 TRACK/TRACE 调用成功，则以下情况为真：

HTTP 状态码 200
message/http 的内容类型

其他任何事情都被视为失败。 405 也被认为是失败（客户端触发的失败，因此状态码为 4xx），因此，就 RFC 而言，这完全符合请求类型的定义方式。所以，真正的问题是，在 RFC 之外，你所期望的与你所拥有的有什么不同？错误响应？

【讨论】：

两个站点的错误响应确实是 405。我使用这个命令来测试 TRACE 方法： curl --insecure -v -X TRACE example.com 用于 SSL 站点和 curl -v -X TRACE example.com 响应的内容是 405 方法不允许非 SSL 和SSL one的完整html
我在我的问题中添加了 SSL 和非 SSL TRACE 的响应，这可能会有所帮助
@chupya：问题仍然存在——你为什么关心一个明显不允许的方法的内容响应？ RFC 没有定义它。但是，在 SSL 版本上，请求仍然通过 PHP（这似乎是生成站点输出的底层方法）。在那种情况下，你能告诉我相关的配置吗？
我的问题是这是否是正常行为，nginx 和 apache 的配置是否正确以及 TRACE 方法是否真的被禁用。我对 TRACE 方法给出的不同响应感到困惑。根据您的要求，我添加了配置文件。
好的，所以预期会有不同的行为。在 405 到 php 后端的情况下，您有一个 proxy_pass。所以，是的，这完全正常。