Internet security : Http Methods

When a client sends an HTTP request it includes a methods specification which tells the server what the client wants it to do. So, for example, a request to retrieve a document will have a method type of GET. When we start to restrict access to files on the server, we will need to specify which method(s) are permitted.



In the IBM Internet Connection Secure Sever the methods are specified by Mask specifications, which are part of the Protection directives. The following is a list of the methods that the servers support and a description of how the server would respond to a client request containing the method. The description assumes the method is enabled.



- GetMask – The server returns whatever data is defined by the URL. If the URL refers to an executable program, the server returns the output of the program. Briefly you can receive and display all the GTML pages, but you cannot submit a form.

- PostMask – The request contains data and a URL. The server creates a new object with the data portion of the request. The server links the new object to the URL sent on the request. The server gives the new object a URL. The server sends the URL of the new object back to the client. The new object is subordinate to the URL contained on the request (the same way a file is subordinate to a directory or a news article is subordinate to a news group.) POST creates new documents; use PUT to replace existing data.

- PutMask - The request contains data and a URL. The URL must already exist on the server. The server deletes the current data defined by the URL and replaces it with the new data contained in the request. PUT replaces existing data; use POST to create new documents. Because PUT lets clients replace information on your server, it’s extremely important you use protection rules to define who you want to be able to use this method.

- Mask – Mask provides the protection definition for the directives that you have not explicitly coded..