Apache prohibits trace or track against XSS attacks

Trace and track are the HTTP methods used to debug Web server connections.
a cross-site scripting vulnerability exists in a server that supports this approach, often referred to as XST when describing various browser defects.
An attacker could exploit this vulnerability to spoof legitimate users and obtain their private information.

Disabling trace can be accomplished by using the rewrite feature
Rewriteengine on
Rewritecondi%{request_method} ^trace
rewriterule. *-[F]

or you can configure the appropriate parameters directly in Apache configuration file.
traceenable off

This article is from "Xiao Yang" blog, please be sure to keep this source http://aqiang.blog.51cto.com/6086626/1895873

Apache prohibits trace or track against XSS attacks