3

According to documentation ,Salesforce supports HTTP trace request type. HTTP Trace Support Salesforce

I was trying a callout HTTP trace method to get network details for debugging DNS issues. But Am getting 405 error. Here is my code.

Http h=new HTTP();
HTTPRequest hr=new HTTPRequest();
hr.SetMethod('TRACE');
hr.setEndpoint('http://www.google.com');
HTTPResponse hresp=h.send(hr);
System.debug(hresp);
  • 1
    You may need to add the domain www.google.com to your security endpoints to allow SFDC to call out. Have you done this? Just search for Remote Site in the setup search box. – Richard Durrant Jul 1 '16 at 10:41
  • Already did that :) google.com is just for referential purpose. Actual endpoint is different. – Pranay Jaiswal Jul 1 '16 at 11:39
  • does your endpoint have TRACE disabled? – Jesse Milburn Jul 1 '16 at 12:21
  • Must be what @JesseMilburn says. Salesforce allows TRACE method so that's not the problem: developer.salesforce.com/docs/atlas.en-us.apexcode.meta/… (scroll down to setMethod()). 405 means the method is not allowed for the endpoint. – Folkert Jul 1 '16 at 13:27
  • Any idea about some sample endpoint that supports trace? Google does though – Pranay Jaiswal Jul 2 '16 at 3:51
6

So, according to OWASP having the TRACE support on your server is generally a bad idea.

TRACE: This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which has been discovered by Jeremiah Grossman (see links at the bottom of the page).

Then in the TraceEnable Directive from the Apache Documentation. [Source]

Note
Despite claims to the contrary, enabling the TRACE method does not expose any security vulnerability in Apache httpd. The TRACE method is defined by the HTTP/1.1 specification and implementations are expected to support it.

Which leads me to believe that the only people publicly brave enough to support it are apache.org.

Http h=new HTTP();
HTTPRequest hr=new HTTPRequest();
hr.SetMethod('TRACE');
hr.setHeader('Testing', 'FooBar');
hr.setEndpoint('http://www.apache.org/');
HTTPResponse hresp=h.send(hr);
System.debug(hresp);
System.debug(hresp.getBody());

So after adding the required Remote Sites setting I get:

enter image description here

Note my testing header getting relayed back in the response body.

Most other servers give something like the following indicating that it isn't supported by the server:

System.HttpResponse[Status=Forbidden, StatusCode=403]

System.HttpResponse[Status=Method Not Allowed, StatusCode=405]

System.HttpResponse[Status=Not Implemented, StatusCode=501]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.