Using HTTP Trace in Salesforce

Question

According to documentation ,Salesforce supports HTTP trace request type. HTTP Trace Support Salesforce

I was trying a callout HTTP trace method to get network details for debugging DNS issues. But Am getting 405 error. Here is my code.

Http h=new HTTP();
HTTPRequest hr=new HTTPRequest();
hr.SetMethod('TRACE');
hr.setEndpoint('http://www.google.com');
HTTPResponse hresp=h.send(hr);
System.debug(hresp);

Answer 1

So, according to OWASP having the TRACE support on your server is generally a bad idea.

TRACE: This method simply echoes back to the client whatever string has been sent to the server, and is used mainly for debugging purposes. This method, originally assumed harmless, can be used to mount an attack known as Cross Site Tracing, which has been discovered by Jeremiah Grossman (see links at the bottom of the page).

Then in the TraceEnable Directive from the Apache Documentation. [Source]

Note
Despite claims to the contrary, enabling the TRACE method does not expose any security vulnerability in Apache httpd. The TRACE method is defined by the HTTP/1.1 specification and implementations are expected to support it.

Which leads me to believe that the only people publicly brave enough to support it are apache.org.

Http h=new HTTP();
HTTPRequest hr=new HTTPRequest();
hr.SetMethod('TRACE');
hr.setHeader('Testing', 'FooBar');
hr.setEndpoint('http://www.apache.org/');
HTTPResponse hresp=h.send(hr);
System.debug(hresp);
System.debug(hresp.getBody());

So after adding the required Remote Sites setting I get:

Note my testing header getting relayed back in the response body.

Most other servers give something like the following indicating that it isn't supported by the server:

System.HttpResponse[Status=Forbidden, StatusCode=403]

System.HttpResponse[Status=Method Not Allowed, StatusCode=405]

System.HttpResponse[Status=Not Implemented, StatusCode=501]