Skip to content

Should FrankenPHP reject TRACE requests in the default configuration? #2521

Description

@gggeek

Describe your feature request

I am testing usage of FrankenPHP to run a php http middleware, and comparing any differences between that and Apache and Nginx (and hopefully in the future other webservers).

One interesting difference which I found, not really related to PHP, is that, in the "stock"* configuration, FrankenPHP does allow http requests with the TRACE method, whereas both Apache and Nginx reject them with a 405 response.

Should FrankenPHP (and/or Caddy) also do the same out of the box?

Note that FrankenPHP/Caddy does not answer to TRACE requests on its own, leaving it up to the single developer's code to implement any real support for it.

`* = the config as found on recent Ubuntu LTS versions after installing the webserver from the repo packages. Note that google search and the blogosphere seem to have quite confused ideas about whether blocking of TRACE requests is enabled by default or should be enabled manually...

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions