IIS: How to disable HTTP method TRACE? - http

Question

I followed this, which led to this to try to disable my website from accepting the TRACE method (verb). Basically I added the section below to <system.webServer> inside Web.config (Default Web Site and the other website):
<security>
<requestFiltering>
<verbs applyToWebDAV="false">
<add verb="TRACE" allowed="false" />
</verbs>
</requestFiltering>
</security>
It didn´t work. Then I went to C:\Windows\System32\inetsrv\config\applicationHost.config and replaced all handlers' verb inside <handlers>. In a nutshell, all lines like this:
<add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
Became this:
<add name="StaticFile" path="*" verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
I even restarted the server but when I check the available methods, TRACE is still there:
$ curl -I -X OPTIONS https://example.com/mysite
HTTP/1.1 200 OK
Allow: OPTIONS, TRACE, GET, HEAD, POST
Public: OPTIONS, TRACE, GET, HEAD, POST
X-XSS-Protection: 1; mode=block
Date: Thu, 07 Feb 2019 21:03:49 GMT
Content-Length: 0
So, how do I get rid of it?

Answer 1

To truly block TRACE requests, you should still keep a request filtering rule with TRACE verb blocked.
The curl command sends an OPTIONS request to IIS, and the ProtocolSupportModule generates the response message,
https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
However, Microsoft did not design any settings in system.webServer/httpProtocol section for you to change the value of the headers so as to hide TRACE from there.
But a workaround is to use URL Rewrite module,
https://blogs.msdn.microsoft.com/benjaminperkins/2012/11/02/change-or-modify-a-response-header-value-using-url-rewrite/
where you create two outbound rules for Allow and Public headers,
<rewrite>
<outboundRules>
<rule name="ChangeHeaders" stopProcessing="false">
<match serverVariable="RESPONSE_Allow" pattern="OPTIONS, TRACE, GET, HEAD, POST" />
<action type="Rewrite" value="OPTIONS, GET, HEAD, POST" />
</rule>
<rule name="Public">
<match serverVariable="RESPONSE_Public" pattern="OPTIONS, TRACE, GET, HEAD, POST" />
<action type="Rewrite" value="OPTIONS, GET, HEAD, POST" />
</rule>
</outboundRules>
</rewrite>

Answer 2

In my case works:
<requestFiltering>
<verbs allowUnlisted="false">
<clear/>
<add verb="GET" allowed="true" />
<add verb="HEAD" allowed="true" />
<add verb="POST" allowed="true" />
</verbs>
</requestFiltering>
Please notice that I don't allow OPTIONS.
When I not allow OPTIONS then TRACE was also not allowed.