Dolibarr/dolibarr · warning

Access refused with request method TRACE

Error message

Access refused with request method TRACE

What it means

waf.inc.php rejects HTTP requests using the TRACE method outright, printing 'Access refused with request method TRACE' and returning HTTP 405. TRACE can be exploited (Cross-Site Tracing) to reflect cookies/authorization headers back to an attacker when a web server has TRACE enabled. This is unconditional protection in core Dolibarr.

Solutions

  1. Nothing to fix on Dolibarr side: use GET/POST/PUT/DELETE instead of TRACE.
  2. Disable TRACE in the web server (Apache: TraceEnable Off; nginx: ignore invalid methods) as defense in depth.
  3. If a proxy/monitor triggers it, change its health-check method to GET or HEAD.
  4. If you must allow TRACE behind your own infrastructure, you would have to remove this guard — strongly discouraged; treat any TRACE traffic as probing.

Example fix

// before (client)
curl -X TRACE https://doli.example.com/
// after
curl -I https://doli.example.com/   # use HEAD/GET for health checks
# Apache hardening alongside:
# TraceEnable Off
Defensive patterns

Strategy: validation

Validate before calling

// client-side guard before issuing a request
const ALLOWED_METHODS = ['GET','POST','PUT','DELETE','HEAD','OPTIONS'];
if (!ALLOWED_METHODS.includes(method)) throw new Error(`Method ${method} rejected by Dolibarr WAF`);

Type guard

function isTraceRequest(method) {
  return typeof method === 'string' && method.toUpperCase() === 'TRACE';
}
// use: if (isTraceRequest(method)) throw new Error('TRACE is blocked by Dolibarr');

Prevention

When it happens

Trigger: Any HTTP TRACE request to any Dolibarr URL; typically from vulnerability scanners, curl -X TRACE, or misconfigured proxies/load balancers health-checking with TRACE.

Common situations: Security scans (nmap/Nessus) probing for XST; reverse-proxy default configs sending TRACE; developers testing header reflection.

Related errors

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/2d4aa30c0aee3a49. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/waf.inc.php:318

					if (class_exists('PHPUnit\Framework\TestSuite')) {
						$message = $errormessage.' '.substr($errormessage2, 2000);
						throw new Exception("Security injection exception: $message");
					}
					exit;
				} else {
					return false;
				}
			}
		}
		return true;
	} else {
		return (testSqlAndScriptInject($var, $type) <= 0);
	}
}

// Prevent the use of method TRACE in case of the web server authorizes it (some do it by default). TRACE method can be used by attacker to steal cookies or other sensitive information.
if (!empty($_SERVER["REQUEST_METHOD"]) && $_SERVER["REQUEST_METHOD"] == "TRACE") {
	print 'Access refused with request method TRACE';
	http_response_code(405);
	exit();
}

// Sanity check on URL
if (!defined('NOSCANPHPSELFFORINJECTION') && !empty($_SERVER["PHP_SELF"])) {
	$morevaltochecklikepost = array($_SERVER["PHP_SELF"]);		// Note:if an url is called with mypage.php/aaa/bbb (used only by API) the aaa/bbb is also part of $_SERVER["PHP_SELF"] so analyzed too.
	analyseVarsForSqlAndScriptsInjection($morevaltochecklikepost, 2);
}
// Sanity check on GET parameters
if (!defined('NOSCANGETFORINJECTION') && !empty($_SERVER["QUERY_STRING"])) {
	// Note: QUERY_STRING is url encoded, but $_GET and $_POST are already decoded
	// Because the analyseVarsForSqlAndScriptsInjection is designed for already url decoded value, we must decode QUERY_STRING
	// Another solution is to provide $_GET as parameter with analyseVarsForSqlAndScriptsInjection($_GET, 1);
	$morevaltochecklikeget = array(urldecode($_SERVER["QUERY_STRING"]));
	analyseVarsForSqlAndScriptsInjection($morevaltochecklikeget, 1);
}
// Sanity check on POST

View on GitHub (pinned to 598aa4bdad)