远端WWW服务支持TRACE请求漏洞修复

本文仅写出tomcat中该漏洞修复步骤

在tomcat的web.xml配置文件中，对不安全的方法进行拦截，禁用TRACE，HEAD，PUT，DELETE，OPTIONS请求方式：

<security-constraint>  
   <web-resource-collection>  
      <url-pattern>/*</url-pattern>  
      <http-method>PUT</http-method>  
	  <http-method>DELETE</http-method>  
	  <http-method>HEAD</http-method>  
	  <http-method>OPTIONS</http-method>  
	  <http-method>TRACE</http-method>  
   </web-resource-collection>  
   <auth-constraint>  
   </auth-constraint>  
</security-constraint>  

在tomcat的在server.xml中先允许TRACE请求

<Connector port="8080" protocol="HTTP/1.1" 
		connectionTimeout="20000" 
		allowTrace="true"
        redirectPort="8443" />

验证结果

修改后：GEt请求正常访问，TRACE请求被拒绝。