[
https://issues.apache.org/jira/browse/NIFI-12925?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17830757#comment-17830757
]
ASF subversion and git services commented on NIFI-12925:
--------------------------------------------------------
Commit 6a8cc9720d089821ae2eb8a631f26364f08f5ca0 in nifi's branch
refs/heads/support/nifi-1.x from Mark Bean
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=6a8cc9720d ]
NIFI-12925 Updated ListenHTTP to return 405 for TRACE and OPTIONS
This closes #8548
Signed-off-by: David Handermann <exceptionfact...@apache.org>d
(cherry picked from commit 5c150ffd786ec37be4821791654c8a65d4a49f6e)
> ListenHTTP should disable unused HTTP methods
> ---------------------------------------------
>
> Key: NIFI-12925
> URL: https://issues.apache.org/jira/browse/NIFI-12925
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Extensions
> Reporter: Michael W Moser
> Assignee: Mark Bean
> Priority: Major
> Time Spent: 1h
> Remaining Estimate: 0h
>
> For [security
> reasons|https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods],
> ListenHTTP should reply with 405 Method Not Allowed for HTTP methods OPTIONS
> and TRACE.
> PUT already returns 405.
> GET, POST, DELETE, HEAD are used by the processor.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
