documentation_complete: true

title: 'Limit Available Methods'

description: |-
    Web server methods are defined in section 9 of RFC 2616 (<weblink-macro link="http://www.ietf.org/rfc/rfc2616.txt" />).
    If a web server does not require the implementation of all available methods,
    they should be disabled.
    <br /><br />
    Note: <tt>GET</tt> and <tt>POST</tt> are the most common methods. A majority of the others
    are limited to the WebDAV protocol.
    <pre>&lt;Directory /var/www/html&gt;
    # ...
       # Only allow specific methods (this command is case-sensitive!)
       &lt;LimitExcept GET POST&gt;
          Order allow,deny
       &lt;/LimitExcept&gt;
    # ...
    &lt;/Directory&gt;</pre>

rationale: |-
    Minimizing the number of available methods to the web client reduces risk
    by limiting the capabilities allowed by the web server.

severity: unknown

identifiers:
    cce: 27581-8
