Webserver question: Options HTTP method - Is this needed?
Hello!
I have a vulnerability on the webserver. If I understand this correctly it is because we have the HTTP OPTIONS Method enabled. I am being asked to disable this option. Is this something that needs enabled for Pega to work? Is this specific to a Pega version to work? I support several Pega versions from 6.2 to 8.4.1.
Thanks!
Pegasystems Inc.
NL
Hi Fred,
By default, Pega Platform uses only POST and GET http methods, so other HTTP methods like OPTIONS can be disabled at the application server level. (https://community.pega.com/sites/default/files/help_v84/procomhelpmain.htm#security/best-practices/sec-security-guidelines-for-test-env-ref.htm)
Even though I think this is also true for older versions including 6.2. I recommend upgrading to a more recent version for enhanced security in many other areas.
If you're using CORS you might need to further investigate to ensure you're not dependent on the OPTIONS method.
Kind regards,
Eric