topic Disabling HTTP Options in Dynatrace Managed Q&A

Disabling HTTP Options

Andy_Evans — Tue, 29 Jan 2019 16:28:24 GMT

Hello,

we are looking to disable HTTP Options on our cluster activegate, per request from our security team as it has raised concerns about potential vulnerabilities. Is there any way that those options can be disabled?

Thanks in advance

Re: Disabling HTTP Options

Babar_Qayyum — Tue, 29 Jan 2019 16:59:34 GMT

Hello @Andrew E.

You can use ActiveGate properties for the configuration. These properties are applicable for both Environment ActiveGates and Cluster ActiveGates.

Have a look on the below link for more insight.

https://www.dynatrace.com/support/help/deploy-dyna...

Regards,

Babar

Re: Disabling HTTP Options

AlexanderSommer — Fri, 01 Feb 2019 17:51:13 GMT

HTTP OPTIONS is necessary for REST API and Real user monitoring (beacon forwarders). The server does not respond with sensitive information, thus
is not considered a security vulnerability.

HTTPS OPTIONS method is also a requirement for CORS
calls: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS