TRACE performs a message loop-back test along the path to the target resource. The server echoes back the exact request it received in the response body. This allows clients to see what changes or additions have been made by intermediate proxies. TRACE is disabled on virtually all production servers due to the Cross-Site Tracing (XST) attack vector.
Properties
| Safe | Yes | Safe methods don't change server state. They are read-only. |
| Idempotent | Yes | Idempotent methods produce the same result if called once or multiple times. |
| Cacheable | No | Cacheable responses may be stored and reused for equivalent requests. |
| Request Body | No | Whether a request body is allowed / expected. |
| Response Body | Yes | Whether a response body is expected. |
Description
TRACE is a diagnostic method – the server reflects the request back as the response body with Content-Type: message/http. This lets you see exactly what a server received, including any headers added by proxies. TRACE combined with XSS was exploited in the XST (Cross-Site Tracing) attack to steal cookies. Modern browsers refuse to send TRACE from JavaScript (XMLHttpRequest/fetch), and Apache, Nginx, and IIS all disable it by default.
Examples
TRACE / HTTP/1.1
Host: example.com
Max-Forwards: 5HTTP/1.1 200 OK
Content-Type: message/http
TRACE / HTTP/1.1
Host: example.com
Max-Forwards: 5
Via: 1.1 proxy.example.com# Reject TRACE in nginx.conf:
if ($request_method = TRACE) { return 405; }