All fixes

Disable the HTTP TRACE method

methods-trace

TRACE echoes the request back, including headers the browser attached on its own. It has no production use, so turn the method off at the server.

Why this matters

Your server accepts TRACE requests, a debug feature that should be off. Browsers have blocked this since 2012 though, so the real-world risk is minimal.

Nginx

  1. 1 Block TRACE method in your server config
nginx 
if ($request_method = TRACE) {
    return 405;
}

Does your app still have this?

Scan your domain