Understanding the HTTP Methods Auditor

The HTTP Methods Auditor is a diagnostic tool designed to help developers and security analysts evaluate which HTTP methods are active and supported on a specific URL. By programmatically sending requests using various methods, the tool maps out the server's accepted request types and evaluates the potential security risks associated with the active methods.

How the Auditing Engine Operates

When you submit a target URL, the tool's backend sequentially dispatches eight distinct HTTP requests, one for each of the core methods: GET, HEAD, POST, PUT, DELETE, OPTIONS, TRACE, and PATCH.

To ensure accurate and isolated testing, the auditor implements specific request configurations directly into its HTTP client:

• Strict Timeouts: Each request has a hard limit of 5 seconds. If the target server does not respond within this window, the tool catches the exception and records the method status as "Timed Out."
• No Redirections: The auditor disables automatic redirects (allow_redirects = false). This guarantees that the test evaluates the exact URL provided rather than following a 301/302 redirect to a different endpoint, which might have entirely different method configurations.
• Relaxed SSL Verification: SSL certificate verification is bypassed (verify = false) during the audit. This allows the tool to test staging servers, internal IP addresses, or legacy applications that might have self-signed or expired SSL certificates.

Evaluating "Allowed" vs. "Disabled" Status

The core of the auditor lies in how it interprets the HTTP response status codes returned by the target server. The classification logic works as follows:

• Allowed: An HTTP method is marked as allowed if the server responds with a status code less than 400 (e.g., 200 OK, 201 Created, 204 No Content). Interestingly, the auditor also explicitly flags methods as allowed if they return 401 Unauthorized or 403 Forbidden. While these codes indicate the user lacks permission to access the resource, they confirm that the server successfully recognized and processed the HTTP method itself.
• Disabled: If the server responds with a 405 Method Not Allowed status, the auditor definitively marks the method as disabled, noting it is "Properly disabled." Additionally, if the request times out without a response, it is treated as inactive.

Security Impact and Risk Classification

Not all HTTP methods carry the same security implications. The auditor categorizes the results into three distinct risk tiers based on the allowed methods:

• High Risk (Danger): If the TRACE method is allowed, it is flagged as a critical vulnerability ("VULNERABLE"). TRACE requests echo back the received request, which malicious actors can exploit to perform Cross-Site Tracing (XST) attacks, potentially stealing sensitive session cookies.
• Medium Risk (Warning): The PUT and DELETE methods are essential for RESTful APIs but pose significant risks if left enabled on static directories or unprotected endpoints. The tool flags these as "ENABLED" and warns that they require careful monitoring.
• Standard (Safe): Methods like GET, HEAD, POST, OPTIONS, and PATCH are treated as standard web application requirements. Unless misconfigured at the application layer, their mere presence is not inherently dangerous.

Concrete Worked Example

Let’s look at a practical scenario. Suppose you enter https://api.example.com/v1/resource into the auditor. The tool executes the sequence of 8 requests.

GET Request: The server returns 200 OK. The auditor marks GET as ALLOWED with no significant risk.

PUT Request: The server returns 401 Unauthorized. Because the server understood the PUT request and merely rejected the lack of credentials, the auditor marks PUT as ENABLED with a Warning severity, advising careful monitoring.

TRACE Request: The server returns 405 Method Not Allowed. The auditor correctly identifies that TRACE is properly disabled, marking the verdict as DISABLED.

PATCH Request: The request exceeds the 5-second timeout limit. The tool catches the exception, outputs a status of "Timed Out," and marks the method as DISABLED.

Frequently Asked Questions