4 ms·
Great analysis except I'm puzzled by his claim about trace.axd -- is it really a security risk that tracing is enabled, given that it can only be accessed from
by skue 14y ago
Great analysis except I'm puzzled by his claim about trace.axd -- is it really a security risk that tracing is enabled, given that it can only be accessed from the local machine?
- alastairpat 14y agoDepending on the configuration, it can be accessed from a remote computer. In this case, it was configured for localhost access, however it is entirely possible that it could be world-accessible.
- skue 14y agoRight... that's like saying "The root password was strong, however it is entirely possible that it could be an empty string." Fortunately, someone on the main article did respond that having trace.axd enabled could result in 500 errors dumping a stack trace. That's a much clearer argument for why having tracing enabled is a bad thing.
- dt7 14y agoI think the point is that it exposes information about the server, like the headers he mentions.