Vulnerabilities
HTTP TRACE vs Least-Privilege Methods for Public APIs
April 23, 2024
HTTP TRACE vs least-privilege methods is a verb-surface choice. TRACE (and the old TRACK alias) should not be on the menu for a public origin. OPTIONS may advertise Allow or Access-Control-Allow-Methods; listing PUT/DELETE/TRACE on routes that only GET is extra surface. Least privilege means each path accepts only the verbs it implements. RoastMyOpsec's app-mode check reads an OPTIONS response — it does not send TRACE bodies or Cross-Site Tracing exploits.
The practical difference
GET, POST, PUT, PATCH, DELETE, and OPTIONS are the usual working set. TRACE asks the server to echo the request, which historically collided with browser cookie and header leakage stories. TRACK is a non-standard cousin some stacks still mention.
Advertising a verb and implementing it are different. An Allow: TRACE line is still a signal you should turn off at the proxy even if the handler is a 405.
How to choose what to allow
Start from the route. A marketing page is GET (and maybe HEAD). A JSON collection might be GET plus POST. Admin mutations should not appear on the public OPTIONS of the brochure host.
| Verb | Typical public use | Default | Takeaway |
|---|---|---|---|
| GET / HEAD | Read documents and APIs | On for public GETs | Still rate-limit abusive clients |
| POST / PUT / PATCH / DELETE | State changes | Only on routes that mutate | Pair with auth and CSRF strategy |
| OPTIONS | CORS preflight | On if browsers call the API | Do not use it as a TRACE substitute |
| TRACE / TRACK | None for production apps | Off at the edge | Classic footgun — disable it |
When a 405 is not enough
Some frameworks still echo TRACE through a generic handler. Disable the method at nginx, the load balancer, or the platform so the request never reaches the app.
CORS Access-Control-Allow-Methods should match reality. Advertising DELETE to the world on a read-only resource is a map, not a feature.
Common mistakes
The first mistake is copying a wildcard Allow from a tutorial.
The second mistake is disabling TRACE in prod and leaving it on a preview host with real cookies.
The third mistake is treating OPTIONS as optional security theater and ignoring what it lists.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is HTTP TRACE a vulnerability by itself?
- It is a dangerous default. Disable it. Cross-site tracing is a historical class of issues; you do not need TRACE in production.
- Should I disable OPTIONS too?
- Not if browsers need CORS preflight. Keep OPTIONS, keep the Allow list tight, and still disable TRACE.
- How does RoastMyOpsec check methods?
- An OPTIONS probe that reads advertised methods. No TRACE payloads, no Cross-Site Tracing tests.