Disabling TRACE on Port 443

Question

User209787992 posted

My school's IT support is not helping me out, so I'm asking for help here.

They want me to disable the TRACE command on HTTP. I did that. But they said I also need to disable TRACE on HTTPS or port 443. Is that a different procedure?

Thank you

Khoi

Answer 1

User690216013 posted

I did that.

What did you do exactly?

Answer 2

User1771714573 posted

Hi artysporty,

I don't know how did you disable TRACE on HTTP, but IIS7 and 10 disable TRACE by default. Only IIS8.5 allows TRACE.

There is no different about disable TRACE on http and port. When TRACE is disabled on server, all request to it will be affected, whatever http and port.

You can disable TRACE in Request Filter of IIS. Just add Deny Verb.

Best regards,

Brucz

Answer 3

User209787992 posted

Hi All,

Yes I blocked the HTTP verbs for TRACE and the infosecurity team at my school confirmed that TRACE was block on HTTP, but not on HTTPS. From what you guys/gals are telling me, this should disable all TRACE on all ports 80 & 443?

Thank you!!

Answer 4

User1771714573 posted

Hi artysporty,

Did you test it correctly? Follow the method I gave you, regardless of http or https, TRACE will be disabled.

This is http:

This is https:

Best regards,

Brucz