TRACE Registered Safe Idempotent
Verified 2026-09-18 · registry updated
2026-06-17TRACE
Performs a message loop-back test along the path to the target.
Use TRACE only for controlled diagnostics; disable it when not required because reflected request data can enable cross-site tracing risks.
httpmethodsdiagnosticssecurity
Reference (http)
TRACE / HTTP/1.1 Host: example.com Max-Forwards: 0
Use TRACE only for controlled diagnostics; disable it when not required because reflected request data can enable cross-site tracing risks.
Common mistakes
- Leaving TRACE enabled by default on a public application.
Registry reference: rfc9110