TRACE Method

About¹

The TRACE HTTP method (HTTP verb) performs a message loop-back test along the path to the target resource.

The final recipient of the request should reflect the message as received (excluding any fields that might include sensitive data) back to the client as the message body of a 200 OK response with a Content-Type of message/http. The final recipient is either the origin server or the first server to receive a Max-Forwards value of 0 in the request.

The client must not send content in the request, or generate headers that might include sensitive data such as user credentials or cookies. Not all servers implement the TRACE method, and some server ownders have historically disallowed the use of the TRACE method due to security concerns. In such cases, a 405 Method Not Allowed client error response will be sent.

Characteristics

Syntax

TRACE <request-target>["?"<query>] HTTP/1.1

• <request-target>: identifies the target resource of the request when combined with the information provided in the Host header. This is an absolute path (e.g., /path/to/file.html) in requests to an origin server, and an absolute URL in requests to proxies (e.g., http://www.examples.com/path/to/file.html).
• <query> (Optional): an optional query component preceded by a question-mark ?. Often used to carry identifying information in the form of key=value pairs.

Examples

Successful TRACE request

A TRACE request can be performed using curl:

curl -v -X TRACE example.com

This produces the following HTTP request :

TRACE / HTTP/1.1
Host: example.com
User-Agent: curl/8.7.1
Accept: */*

A 200 OK response with the request headers contained in the response body is sent back to the client:

HTTP/1.1 200 OK
Content-Length: 123
Date: Wed, 07 May 2025 03:07:03 GMT
Server: Apache/2.4.59 (Unix)
Content-Type: message/http

TRACE / HTTP/1.1
Host: example.com
User-Agent: curl/8.7.1
Accept: */*

Anki

Links

• HTTP method (HTTP verb)

References