node.js - NodeJS HTTP 服务器 - 禁用 HTTP 方法、跟踪跟踪等

Question

在我的 NodeJS HTTP 服务器上运行 nmap 我得到:

nmap -p 443 --script http-methods localhost

Starting Nmap 6.40 ( http://nmap.org ) at 2016-10-28 11:26 BST
Nmap scan report for localhost
Host is up (0.00051s latency).
PORT    STATE SERVICE
443/tcp open  https
| http-methods: ACL BIND CHECKOUT CONNECT COPY DELETE GET HEAD LINK LOCK M-SEARC                                                 H MERGE MKACTIVITY MKCALENDAR MKCOL MOVE NOTIFY PATCH POST PROPFIND PROPPATCH PU                                                 RGE PUT REBIND REPORT SEARCH SUBSCRIBE TRACE UNBIND UNLINK UNLOCK UNSUBSCRIBE
| Potentially risky methods: ACL BIND CHECKOUT CONNECT COPY DELETE LINK LOCK M-S                                                 EARCH MERGE MKACTIVITY MKCALENDAR MKCOL MOVE NOTIFY PATCH PROPFIND PROPPATCH PUR                                                 GE PUT REBIND REPORT SEARCH SUBSCRIBE TRACE UNBIND UNLINK UNLOCK UNSUBSCRIBE
|_See http://nmap.org/nsedoc/scripts/http-methods.html
MAC Address: AB:CD:75:EF:A5:6D (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 0.12 seconds

所以我希望禁用其中一些方法，主要是在“潜在风险方法:”列表中。

这在 Apache 中非常简单，但我看不到在 NodeJS 中有任何方法可以做到这一点。

This SO question谈到编辑 Node 的 C 源代码，但我真的不想那样做。

The node docs显示一个 http.METHODS 方法，但这只是一个 get。

Answer 1

在 NodeJS help github 上询问并得到了 bnoordhuis 的回复:

const allowedMethods = ['GET','HEAD','POST'];

function onrequest(req, res) {
  if (!allowedMethods.includes(req.method))
    return res.end(405, 'Method Not Allowed');
  // ...
}

https://github.com/nodejs/help/issues/357