: Put and delete - HTTP method

William Muriithi <[email protected]>
Newsgroups gmane.org.user-groups.linux.tolug
Message-ID <CAE9rU+7wiCqvYFNMn_7Bfvs7DETk-wS6hxz64-xv_ZSdx7eaxg@mail.gmail.com>
Morning,

I am curious to hear what opinion or experience this group has on disabling
HTTP put and delete method.

Essentially, last week, I scanned around to see if there is weakness on the
systems I support that's exposed to the public. I am looking through the
results and it feel like put and delete shouldn't be enabled. The lines
below appear across all the systems results

+ OSVDB-397: HTTP method ('Allow' Header): 'PUT' method could allow clients
to save files on the web server.
+ OSVDB-5646: HTTP method ('Allow' Header): 'DELETE' may allow clients to
remove files on the web server.

To be sincere I don't see a problem with put and delete from a bit of
Googling I have done. Seem you can do the same damage through post that you
can execute using put and delete yet, we don't disable the former.

What is your opinion or experience with the two HTTP methods? Would
appreciate some enlightenment/criticism here.

Thanks in advance.

William
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.