Increasing Security

The HTTP OPTIONS method provides a list of the methods that are supported by the web server, it represents a request for information about the communication options available on the request/response chain identified by the Request-URI. This may expose sensitive information that could be used to breach security. Therefore, we recommend that you disable the HTTP OPTIONS Method on the web server.

To disable the HTTP OPTIONS Method on the web server:

Navigate to the appropriate web.config file, by default this is:

C:\WDA.Applications\TechInfo Manager\5.0.11\Gatekeeper\Customer\Website

C:\WDA.Applications\TechInfo Manager\5.0.11\ChangeManager\Customer\Website

Make a backup of the file in case you want to undo the changes later.

Open the web.config file and add the following:

<configuration>
<system.webServer>
<security>
<requestFiltering>
<verbs allowUnlisted="true">
<add verb="OPTIONS" allowed="false" />
</verbs>
</requestFiltering>
</security>
</system.webServer>
</configuration>

Save the web.config file.

For information, see AVEVA NET Gatekeeper and AVEVA Change Manager Installation Guide.