Diagnostic method
TRACE HTTP Method
TRACE requests run a diagnostic loop-back of the request path.
Meaning
The client asks for a loop-back response of the request message for diagnostics.
Common uses
Use TRACE only for protocol diagnostics where it is explicitly enabled and safe for the environment.
What to check
Check whether TRACE is disabled by policy and avoid exposing sensitive headers in diagnostic responses.
Example request
TRACE / HTTP/1.1
Host: example.comProperties
- Safe
- Yes. A safe method is intended only to read data.
- Idempotent
- Yes. Repeating the same request should have the same intended effect.
- Cacheable
- No
- Request body
- Usually no
References
- Registry
- IANA HTTP Method Registry
- Guide
- MDN TRACE