Make disabling TRACE method usable in a .htaccess file

[Malvoz]

For consistency - similarly to ServerTokens Prod which is only available from the main server config file, the TraceEnable directive shouldn't be enabled by default.

This PR adds an alternative method for disallowing TRACE from .htaccess instead, which is enabled by default.

[XhmikosR]

I can't comment on this being I have no experience with this specific case.

[Malvoz]

This is merely a PR to remain consistent (hence the reference to the ServerTokens Prod implementation) in not assuming the developer has access to the main server config file. The TraceEnable directive is not available in the context of .htaccess.

[LeoColomb]

Thanks for your PR, @Malvoz!

the reference to the ServerTokens Prod

Well, that's not exactly the same since ServerTokens Prod & ServerSignature Off don't do the exact same thing.
Here, the two parts do the same thing, right?

alternative method for disallowing TRACE from .htaccess

Did you actually test it?

[Malvoz]

A bit confusing to me is that TraceEnable is disabled (commented out) in the /dist version but not in /src whereas ServerTokens Prod is disabled in both places. So in the dist version both TraceEnable and ServerTokens Prod are disabled which makes sense (now that I realized it).

[Malvoz]

Did you actually test it?

I thought these things were also tested before implemented on your side. No I did not test the TRACE Method, however I did test the same snippet replacing TRACE with GET and successfully returned a 405 Method Not Allowed status for the GET request.

[LeoColomb]

@Malvoz Ooops, sorry for late reply, I didn't see your reply.

A bit confusing to me is that TraceEnable is disabled

This is because building configuration:

server-configs-apache/htaccess.conf

Line 78 in 029d244

disable "src/security/trace_method.conf"

I thought these things were also tested before implemented on your side.

Yes, it is partly tested manually. But in this case I wonder if a request with TRACE method will even make Apache read the .htaccess. It seems to, but that's what lead to my question. 🙂

[LeoColomb]

Thanks, @Malvoz.
I'm moving the "conf" part in #188, making your suggestion as the preference for .htaccess files.