Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of tevans.uk@googlemail.com
 designates 209.85.214.45 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <74E8D133-C719-4DA9-8E3D-2F0D95D29AE5@gbiv.com>
References: 
 <CALK=YjO0q0ky==5dNfjRf6LYZ+P4EvLtGtfVQbj50i8BmxoPQQ@mail.gmail.com>
	<DF258780-D8E7-4F4A-A244-2F932A70DCE0@gbiv.com>
	<201203202004.31796.sf@sfritsch.de>
	<10EBFF04-E21C-4BE2-8373-9335CC4FAC4E@jaguNET.com>
	<74E8D133-C719-4DA9-8E3D-2F0D95D29AE5@gbiv.com>
Date: Thu, 22 Mar 2012 15:07:53 +0000
Message-ID: 
 <CAFHbX1L5nr6kV6hiAPOCFQq70cXW0o4FcASQYiWhK3Tx60-xHw@mail.gmail.com>
Subject: Re: TRACE still enabled by default
From: Tom Evans <tevans.uk@googlemail.com>
To: dev@httpd.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Mar 21, 2012 at 7:33 PM, Roy T. Fielding <fielding@gbiv.com> wrote:
> TRACE won't work at all if the most popular end-point doesn't support it.
>
> If folks want to protect clients (including gateways) against their own
> stupidity regarding what they choose to send in a TRACE request, then
> do so by selectively removing some lines from the response and I will
> try to update the standard accordingly.
>
> Turning it off by default is not an option. =C2=A0I will veto that.
>
> ....Roy

How about providing a simpler way of turning it off, rather than
turning it off by default? Arbitrarily, it seems, you can't use Limit
or LimitExcept to restrict it, and instead have to use a RewriteRule.

Cheers

Tom