Blocking HTTP methods using HAPROXY

3
votes

How to construct HAPROXY configuration file to block requests for specific HTTP methods?

We're starting to see a number of attacks using methods that we do not support in our apps. We would prefer to reject the traffic at our load balancers rather than have our apps get bogged down with them.

2
haproxy
Not a programming problem (but instead a sysadmin problem) - KevinDTimm
I modified the question to ask what I really wanted, which according to freedictionary.com is programming: creating a sequence of instructions to enable the computer to do something. - rob_hicks
This might help: github.com/mmalecki/npmjs.eu/blob/master/haproxy.cfg - kozlice
serverfault.com - KevinDTimm

2 Answers

11
votes

Try putting this in:

acl valid_method method GET HEAD
http-request deny if ! valid_method

this will deny any method that is NOT GET or HEAD. Change it to suit your needs

1
votes
acl kill_it method TRACE
http-request deny if kill_it

Place this in the frontend section to explicitly deny the TRACE method.