[jira] Commented: (SLING-1340) TRACE is supported and probably should not be by default

["Ian Boston (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SLING-1340?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12828373#action_12828373 ] 

Ian Boston commented on SLING-1340:
-----------------------------------

If the tace method is denied the SlingMainServlet will respond with 
 response.sendError(405);
 response.setHeader("Allow", "GET, HEAD, POST, PUT, DELETE, OPTIONS");

Configured by a boolean property on the SlingMainServlet 

sling.trace.allow

default value is false denying TRACE.

> TRACE is supported and probably should not be by default
> --------------------------------------------------------
>
>                 Key: SLING-1340
>                 URL: https://issues.apache.org/jira/browse/SLING-1340
>             Project: Sling
>          Issue Type: Bug
>          Components: Engine
>    Affects Versions: Engine 2.0.6
>            Reporter: Ian Boston
>            Assignee: Ian Boston
>             Fix For: Engine 2.1.0
>
>
> A per httpd, TRACE should be off by default.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.