http TRACE method does not work as expected
search cancel

http TRACE method does not work as expected

book

Article ID: 435517

calendar_today

Updated On:

Products

CA API Gateway

Issue/Introduction

Normal behaviour for an unconfigured method a Published Web API service would be to return the error as configured in the cluster wide property soapfault.level in combination with soapfault.template (default the Generic SOAP fault). For the TRACE method to allow the service should be configured with Allowed HTTP Methods "Other", for which I would expect the message would be handled by the service policy.

However both give the same (non-standard) behaviour.

The API Gateway always give a HTTP response 405 "Method Not Allowed" with the body

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
    <title>405 Method Not Allowed</title>
</head>
<body>
    <h1>Method Not Allowed</h1>
    <h3>The specified HTTP method is not allowed for the requested resource.</h3>
</body>
</html>

 

Could you explain why this behavior is different compared to other http methods

 

Environment

API Gateway 11.2 

Cause

In API Gateway 11.2.x, certain Tomcat configurations were deprecated or restricted. This prevents the TRACE method from being passed to the policy layer, resulting in a hardcoded 405 response from the underlying container rather than the Gateway's standard soap fault handling.

HTTP TRACE Method Blocked When "Other" is Selected

  1. Issue: When configuring a service's "Allowed HTTP Methods" property, selecting the "Other" checkbox correctly allows the Gateway to accept non-standard or extension HTTP methods. However, requests using the HTTP TRACE method will still be rejected. This occurs because the underlying HTTP transport layer explicitly blocks the TRACE method by default to protect against Cross-Site Tracing (XST) security vulnerabilities. As a result, the request is dropped at the transport layer before the Gateway can process it.
  2. Workaround: None. The blocking of the TRACE method is an intentional security baseline enforced at the transport layer.

A solution to enable the transport layer handled by Tomcat is expected to be in gateway 11.1.4 and 11.2.2 

 

Resolution

11.1.4

Powered by Wolken Software