{"record":{"id":"2d4aa30c0aee3a49","repo":"Dolibarr/dolibarr","slug":"access-refused-with-request-method-trace","errorCode":null,"errorMessage":"Access refused with request method TRACE","messagePattern":"Access refused with request method TRACE","errorType":"http","errorClass":null,"httpStatus":405,"severity":"warning","filePath":"htdocs/waf.inc.php","lineNumber":318,"sourceCode":"\t\t\t\t\tif (class_exists('PHPUnit\\Framework\\TestSuite')) {\n\t\t\t\t\t\t$message = $errormessage.' '.substr($errormessage2, 2000);\n\t\t\t\t\t\tthrow new Exception(\"Security injection exception: $message\");\n\t\t\t\t\t}\n\t\t\t\t\texit;\n\t\t\t\t} else {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t} else {\n\t\treturn (testSqlAndScriptInject($var, $type) <= 0);\n\t}\n}\n\n// Prevent the use of method TRACE in case of the web server authorizes it (some do it by default). TRACE method can be used by attacker to steal cookies or other sensitive information.\nif (!empty($_SERVER[\"REQUEST_METHOD\"]) && $_SERVER[\"REQUEST_METHOD\"] == \"TRACE\") {\n\tprint 'Access refused with request method TRACE';\n\thttp_response_code(405);\n\texit();\n}\n\n// Sanity check on URL\nif (!defined('NOSCANPHPSELFFORINJECTION') && !empty($_SERVER[\"PHP_SELF\"])) {\n\t$morevaltochecklikepost = array($_SERVER[\"PHP_SELF\"]);\t\t// Note:if an url is called with mypage.php/aaa/bbb (used only by API) the aaa/bbb is also part of $_SERVER[\"PHP_SELF\"] so analyzed too.\n\tanalyseVarsForSqlAndScriptsInjection($morevaltochecklikepost, 2);\n}\n// Sanity check on GET parameters\nif (!defined('NOSCANGETFORINJECTION') && !empty($_SERVER[\"QUERY_STRING\"])) {\n\t// Note: QUERY_STRING is url encoded, but $_GET and $_POST are already decoded\n\t// Because the analyseVarsForSqlAndScriptsInjection is designed for already url decoded value, we must decode QUERY_STRING\n\t// Another solution is to provide $_GET as parameter with analyseVarsForSqlAndScriptsInjection($_GET, 1);\n\t$morevaltochecklikeget = array(urldecode($_SERVER[\"QUERY_STRING\"]));\n\tanalyseVarsForSqlAndScriptsInjection($morevaltochecklikeget, 1);\n}\n// Sanity check on POST","sourceCodeStart":300,"sourceCodeEnd":336,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/waf.inc.php#L300-L336","documentation":"waf.inc.php rejects HTTP requests using the TRACE method outright, printing 'Access refused with request method TRACE' and returning HTTP 405. TRACE can be exploited (Cross-Site Tracing) to reflect cookies/authorization headers back to an attacker when a web server has TRACE enabled. This is unconditional protection in core Dolibarr.","triggerScenarios":"Any HTTP TRACE request to any Dolibarr URL; typically from vulnerability scanners, curl -X TRACE, or misconfigured proxies/load balancers health-checking with TRACE.","commonSituations":"Security scans (nmap/Nessus) probing for XST; reverse-proxy default configs sending TRACE; developers testing header reflection.","solutions":["Nothing to fix on Dolibarr side: use GET/POST/PUT/DELETE instead of TRACE.","Disable TRACE in the web server (Apache: TraceEnable Off; nginx: ignore invalid methods) as defense in depth.","If a proxy/monitor triggers it, change its health-check method to GET or HEAD.","If you must allow TRACE behind your own infrastructure, you would have to remove this guard — strongly discouraged; treat any TRACE traffic as probing."],"exampleFix":"// before (client)\ncurl -X TRACE https://doli.example.com/\n// after\ncurl -I https://doli.example.com/   # use HEAD/GET for health checks\n# Apache hardening alongside:\n# TraceEnable Off","handlingStrategy":"validation","validationCode":"// client-side guard before issuing a request\nconst ALLOWED_METHODS = ['GET','POST','PUT','DELETE','HEAD','OPTIONS'];\nif (!ALLOWED_METHODS.includes(method)) throw new Error(`Method ${method} rejected by Dolibarr WAF`);","typeGuard":"function isTraceRequest(method) {\n  return typeof method === 'string' && method.toUpperCase() === 'TRACE';\n}\n// use: if (isTraceRequest(method)) throw new Error('TRACE is blocked by Dolibarr');","tryCatchPattern":null,"preventionTips":["Never use TRACE against a Dolibarr server.","Configure health checks and monitoring to use GET/HEAD.","Disable TRACE in the underlying web server (Apache TraceEnable Off) as defense in depth.","Treat TRACE probes in access logs as vulnerability scanning and alert on them."],"tags":["security","http-method","waf","xst"],"backgroundTag":"operation-not-supported","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}