Rejecting TRACE with middleware in a rails app

reject-trace.md

lib/reject_trace.rb

module Rack

  class RejectTrace
    def initialize(app)
      @app = app
    end

    def call(env)
      status, headers, body = @app.call(env)

      if env["REQUEST_METHOD"] == "TRACE"
        body.close if body.respond_to? :close
        [status, headers, []]
      else
        [status, headers, body]
      end
    end
  end
end

config/application.rb

config.autoload_paths += %W(#{config.root}/lib)
config.middleware.use "RejectTrace"