4 ms·
Actually if you want to pass most PCI compliance scans, you have to not respond to HTTP HEAD requests.
by rstupek 12y ago
Actually if you want to pass most PCI compliance scans, you have to not respond to HTTP HEAD requests.
- toomuchtodo 12y agoPCI compliance scans are, for the most part, a joke. If that's true, it's truly ridiculous.
- quicksilver03 12y agoHave you got a reference for that or it's based on your experience with PCI scan vendors?
- jlgaddis 12y agoIt would be in the PCI DSS [0]. [0]: https://www.pcisecuritystandards.org/security_standards/documents.php https://www.pcisecuritystandards.org/security_standards/docu...
- jamiesonbecker 12y ago"most?" Not in my experience, but anyway, that'd be really dumb. HEAD is extremely useful for checking etag caches. Failing to ask for a full HTTP body is not an exploitable security flaw. ;)