https://bz.apache.org/bugzilla/show_bug.cgi?id=65357
--- Comment #1 from abernal <[email protected]> --- Proposed fix: https://github.com/apache/httpd/pull/826 The 405 for a TRACE denied by TraceEnable is sent from ap_send_http_trace() (and from mod_proxy's own TRACE check) before any handler has declared the methods of the resource, so Allow is empty. Reproduced on trunk: TRACE /f.txt gives "405" with "Allow:" while OPTIONS /f.txt lists GET,POST,OPTIONS,HEAD. The status stays 405 as documented for TraceEnable. The patch lists in Allow the methods httpd answers for any resource: GET and HEAD (RFC 9110 9.1) and OPTIONS. TRACE is not listed, as in the OPTIONS response. Limitation: the list can be shorter than the real methods of the resource (e.g. POST on a CGI), since they are not known at that point. A regression test is included. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
