You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Joe Orton <jo...@redhat.com> on 2016/06/29 11:55:34 UTC
[PATCH] on TRACE & RFC compliance
We had a couple of people complaining about the language around TRACE in
the docs, which say disabling TRACE "makes your server noncompliant", a
claim I found hard to support.
All methods but HEAD and GET are defined as OPTIONAL, so I'm not sure
how this is true, am I missing something?
https://tools.ietf.org/html/rfc2616#section-5.1.1
https://tools.ietf.org/html/rfc7231#section-4.1
Is that choice of words just to scare people off? IIRC there are some
pretty strong opinions on this; attached is how I'd change it.
Re: [PATCH] on TRACE & RFC compliance
Posted by Joe Orton <jo...@redhat.com>.
Thanks a lot, all. I dropped the last sentence and pushed to trunk &
2.4.x. r1750750 & r1750752
Re: [PATCH] on TRACE & RFC compliance
Posted by Ruediger Pluem <rp...@apache.org>.
On 06/29/2016 02:44 PM, Eric Covener wrote:
> On Wed, Jun 29, 2016 at 8:08 AM, William A Rowe Jr <wr...@rowe-clan.net> wrote:
>> The wording change seems fine to me, I'd actually be fine with simply
>> dropping
>> your last sentence entirely. Our config defaults speak for themselves.
>
>
> I think the last sentence is a little strong too. People are just
> going to disable it based on commercial scanners anyway.
>
+1
Regards
R�diger
Re: [PATCH] on TRACE & RFC compliance
Posted by Eric Covener <co...@gmail.com>.
On Wed, Jun 29, 2016 at 8:08 AM, William A Rowe Jr <wr...@rowe-clan.net> wrote:
> The wording change seems fine to me, I'd actually be fine with simply
> dropping
> your last sentence entirely. Our config defaults speak for themselves.
I think the last sentence is a little strong too. People are just
going to disable it based on commercial scanners anyway.
--
Eric Covener
covener@gmail.com
Re: [PATCH] on TRACE & RFC compliance
Posted by William A Rowe Jr <wr...@rowe-clan.net>.
The wording change seems fine to me, I'd actually be fine with simply
dropping
your last sentence entirely. Our config defaults speak for themselves.
On Wed, Jun 29, 2016 at 6:55 AM, Joe Orton <jo...@redhat.com> wrote:
> We had a couple of people complaining about the language around TRACE in
> the docs, which say disabling TRACE "makes your server noncompliant", a
> claim I found hard to support.
>
> All methods but HEAD and GET are defined as OPTIONAL, so I'm not sure
> how this is true, am I missing something?
>
> https://tools.ietf.org/html/rfc2616#section-5.1.1
> https://tools.ietf.org/html/rfc7231#section-4.1
>
> Is that choice of words just to scare people off? IIRC there are some
> pretty strong opinions on this; attached is how I'd change it.
>