4.6 Ensure 'HTTP Trace Method' is disabled - Default


The HTTP TRACE method returns the contents of client HTTP requests in the entity-body of the TRACE response. Attackers could leverage this behavior to access sensitive information, such as authentication data or cookies, contained in the HTTP headers of the request. One such way to mitigate this is by using the <verbs> element of the <requestFiltering> collection, which was introduced in IIS. The <verbs> element replaces the [AllowVerbs] and [DenyVerbs] features in IIS 6.0 UrlScan. It is recommended the HTTP TRACE method be denied.

Attackers may abuse HTTP TRACE functionality to gain access to information in HTTP headers such as cookies and authentication data. This risk can be mitigated by not allowing the TRACE verb.


1. Open Internet Information Services (IIS) Manager
2. In the Connections pane, select the site, application, or directory to be configured
3. In the Home pane, double-click Request Filtering
4. In the Request Filtering pane, click the HTTP verbs tab, and then click Deny Verb... in the Actions pane
5. In the Deny Verb dialog box, enter the TRACE, and then click OK

See Also


Item Details


References: 800-53|CM-6b., CSCv6|3.1

Plugin: Windows

Control ID: c594b4d125e7321503e3d18c7ca0a5155331ffe08bd28fcc99bc4a267fd7da40