Search code examples
.netiisiis-10

Under IIS, I blocked HEAD,TRACE in request filtering, but it keeps appearing on the allowed methods list

Under IIS, I blocked HEAD,TRACE in request filtering, but it keeps appearing on the allowed methods list.

Allow methods

web.config file

It works functionally but does not disappear from the allow method. I don't know why.

i want to solve this problem

Solution

  • You need to create two outbound rules for the Allow and Public headers using the URL Rewrite module.

    <rewrite>
    <outboundRules>
        <rule name="ChangeHeaders" stopProcessing="false">
            <match serverVariable="RESPONSE_Allow" pattern="OPTIONS, TRACE, GET, HEAD, POST" />
            <action type="Rewrite" value="OPTIONS, GET, POST" />
        </rule>
        <rule name="Public">
            <match serverVariable="RESPONSE_Public" pattern="OPTIONS, TRACE, GET, HEAD, POST" />
            <action type="Rewrite" value="OPTIONS, GET, POST" />
        </rule>
    </outboundRules>
</rewrite>

    You can refer to Lex Li's answer in this thread, hope it can help you!