Configuration: HTTP Method Override¶

Identifier: http_method_override

Scanner(s) Support¶

Description¶

Applications may incorrectly honor HTTP method override headers or parameters, allowing attackers to access alternate request handling paths or bypass method-based controls.

How we test: We send requests with method override mechanisms such as X-HTTP-Method-Override, X-Method-Override, and _method parameters, then compare responses to detect when the effective method changes unexpectedly.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  http_method_override:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.