meta
HTTP TRACE
Performs a message loop-back test along the path to the target resource, so the client can see exactly what proxies received. The final recipient echoes the request back as the message body of a 200 response.
TRACE /path HTTP/1.1Properties
| Property | Value / Meaning |
|---|---|
| Safe | Yes - TRACE is diagnostic and has no side effects on resources. |
| Idempotent | Yes - repeating TRACE returns an equivalent echo each time. |
| Cacheable | No - responses are per-request diagnostic echoes. |
| Has body | No - a body must not be sent; servers ignore it. |
| Body in response | Yes - the response body is the exact received request with Content-Type: message/http. |
Examples
curl -X TRACE -i https://example.com/Ask the server to echo the received request for debugging.
TRACE /debug HTTP/1.1\nHost: example.com\nMax-Forwards: 0Max-Forwards: 0 stops at the first proxy, useful for hop-by-hop inspection.
curl -X TRACE -H 'X-Debug: 1' https://example.com/Verify how intermediaries mutate your custom headers.
curl -X TRACE -H 'Max-Forwards: 3' https://example.com/Trace up to 3 proxy hops before echoing back.
Gotcha
TRACE is disabled on most production servers because of the historical Cross-Site Tracing (XST) attack. Cookies and Authorization headers get echoed back verbatim, so never enable TRACE on user-facing hosts.
Related methods
HTTP OPTIONS
Asks the server which communication options (methods, headers, CORS rules) are available for the target resource. Widely used by browsers as the CORS preflight before non-simple cross-origin requests.
HTTP CONNECT
Requests that an HTTP proxy establish a TCP tunnel to the origin server identified by the request-target, typically for HTTPS traffic. After a 2xx response, the connection is no longer HTTP - it becomes an opaque byte pipe.
HTTP GET
Requests a representation of the specified resource. It is the most common HTTP method and should have no side effects on the server.