How to disable methods from the https://localhost:8000 ?

[sangsun0203]

When I make
curl -v -X https://127.0.0.1:8000

It returns
Accept: all or any(/) it seems like all methods are working. It means that GET, POST, HEAD, OPTIONS are working.

But, I want make only working on get, post. Because, security reasons.
How could I make it?

[chrisyounger · Accepted solution]

You can't change it.

If this is really important to you, then put an NGINX or other type of reverse proxy in front of Splunk. Splunk on port 8000 uses all these verbs becuase it is also a REST service on some paths.

As far as security risks go, web servers that accept the extra verbs is an info-level risk in my opinion.

See also this post for a similar question about universal forwarders: https://answers.splunk.com/answers/715424/a-vulnerability-scan-revealed-that-http-options-me.html?ch...

[sangsun0203]

Thanks for your help! I spend whole my weekend for limitation of methods.

[chrisyounger]

happy I could be of help 🙂