[ https://issues.apache.org/jira/browse/NIFI-12925?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17830757#comment-17830757 ]
ASF subversion and git services commented on NIFI-12925: -------------------------------------------------------- Commit 6a8cc9720d089821ae2eb8a631f26364f08f5ca0 in nifi's branch refs/heads/support/nifi-1.x from Mark Bean [ https://gitbox.apache.org/repos/asf?p=nifi.git;h=6a8cc9720d ] NIFI-12925 Updated ListenHTTP to return 405 for TRACE and OPTIONS This closes #8548 Signed-off-by: David Handermann <exceptionfact...@apache.org>d (cherry picked from commit 5c150ffd786ec37be4821791654c8a65d4a49f6e) > ListenHTTP should disable unused HTTP methods > --------------------------------------------- > > Key: NIFI-12925 > URL: https://issues.apache.org/jira/browse/NIFI-12925 > Project: Apache NiFi > Issue Type: Improvement > Components: Extensions > Reporter: Michael W Moser > Assignee: Mark Bean > Priority: Major > Time Spent: 1h > Remaining Estimate: 0h > > For [security > reasons|https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods], > ListenHTTP should reply with 405 Method Not Allowed for HTTP methods OPTIONS > and TRACE. > PUT already returns 405. > GET, POST, DELETE, HEAD are used by the processor. -- This message was sent by Atlassian Jira (v8.20.10#820010)