HTTP OPTIONS method use in Endpoint Protection Manager

Products

• Endpoint Protection

Issue/Introduction

1. Does Endpoint Protection Manager (SEPM) use the HTTP OPTIONS method?
2. What is it used for?
3. If HTTP OPTIONS method is blocked, will it cause any problems for SEPM?

Environment

Endpoint Protection Manager 14.3.x

Resolution

1. No, SEPM does not use the HTTP OPTIONS method for its operations. In fact, the SEPM web server configuration explicitly disables the 'OPTIONS' method (along with other unused methods like 'TRACE', 'CONNECT', 'PROPFIND', etc.) for security hardening purposes.
   
   
2. In general web applications, the 'OPTIONS' method is typically used for CORS (Cross-Origin Resource Sharing) preflight checks to determine if a cross-origin request is safe to send. However, since SEPM does not utilize this mechanism and explicitly blocks the method, it serves no function in the SEPM environment.
   
   
3. No, blocking the HTTP OPTIONS method at a firewall, load balancer, or other network device will not cause any problems.
   
   Reasoning: SEPM's internal 'web.xml' configuration already rejects 'OPTIONS' requests with a security constraint (effectively a "Deny All" rule).