Skip to content

Should FrankenPHP reject TRACE requests in the default configuration? #2521

Description

@gggeek

Describe your feature request

I am testing usage of FrankenPHP to run a php http middleware, and comparing any differences between that and Apache and Nginx (and hopefully in the future other webservers).

One interesting difference which I found, not really related to PHP, is that, in the "stock"* configuration, FrankenPHP does allow http requests with the TRACE method, whereas both Apache and Nginx reject them with a 405 response.

Should FrankenPHP (and/or Caddy) also do the same out of the box?

Note that FrankenPHP/Caddy does not answer to TRACE requests on its own, leaving it up to the single developer's code to implement any real support for it.

`* = the config as found on recent Ubuntu LTS versions after installing the webserver from the repo packages. Note that google search and the blogosphere seem to have quite confused ideas about whether blocking of TRACE requests is enabled by default or should be enabled manually...

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions