ASVS 5.0 V13.4.4 is a Level 2 requirement. Production systems must not support the HTTP TRACE method.
TRACE echoes the request back to the client. That is a diagnostic feature nobody needs on a live site.
Why it matters
An echoed request includes headers added along the path. Historically, cross site tracing could be used to read headers that scripts should not see. Modern browsers block most of that, but the requirement stays because the echo can still reveal internal headers added by proxies, such as addresses and authentication hints.
How to implement it
nginx rejects TRACE with 405 in most builds, but make it explicit:
if ($request_method = TRACE) { return 405; }
Apache:
TraceEnable off
Tomcat disables it by default through allowTrace="false" on the connector. Confirm that the value was not changed.
Also check every layer: the load balancer, the CDN, the application server and any sidecar.
How to test it
curl -i -X TRACE https://example.com/ -H "X-Probe: abc123"
Pass: a 405, 403 or 501 and no echo of X-Probe in the body. Fail: a 200 with message/http content that repeats your header.
Common mistakes
- Testing only the CDN hostname and not the origin.
- Assuming the framework handles it when a separate reverse proxy answers TRACE itself.
- Blocking TRACE but allowing arbitrary methods through to the application.
Quick check
Which status code should I expect?
Any refusal is fine: 405 Method Not Allowed is the most accurate, and 501 or 403 also pass. The thing to verify is that nothing is echoed back.
