Limit HTTP VERBS on Apache2
- by user72295
I am trying to limit the use of certain HTTP verbs on my site. I entered the following into my VirtualHost config file within the Directory element:
<Limit GET POST HEAD>
Allow from all
</Limit>
<Limit PUT DELETE OPTIONS>
Deny from all
</Limit>
This seemed to work but with unexpected results:
I ran the following telnet/HTTP commands before and after this change,
open server 80
OPTIONS server/abs_path HTTP/1.1
User-Agent: Telnet/1.0
Host: server
before the change I received a successful response with the Allowed headers.
After the change, however, I was expecting to receive a 405 'Method not allowed' response but rather I received a 403 'Access Forbidden' response.
What do I need to change in apache to return the 405 HTTP response?
Many thanks
