1

A recent security audit recommended that I disable the HTTP methods DELETE and OPTIONS. I am not opposed to doing this, but have been unable to find any documentation indicating that I can do so safely, without degrading functionality in the CMS.

Does Sitecore need/use the DELETE and/or OPTIONS HTTP methods? Is there documentation to support one way or another?

Improve this question

2 Answers 2

Reset to default
2

I put the question to Sitecore support, who came back with three points on this (paraphrasing):

  • 'Pure' Sitecore uses only POST and GET
  • Modules may use other verbs, particularly if communicating with a 3rd party (Ex: Social Connected, item WebAPI, WebDAV)
  • Because of the use in modules, disabling the verbs is not recommended (emphasis mine)

My takeaway; Your own mileage may vary depending on the modules you need, but tread lightly if your instance is anything more than basic.

Improve this answer
1

I have the options disabled on a live website and that is running fine. So that should work.

Not sure about the delete method however. Didn't test that one yet. It might be used in an api, but maybe someone else can confirm that.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.