topic Re: HTTP Methods in QlikView

HTTP Methods

Mon, 26 Jan 2026 18:19:17 GMT

Hi friends, hope all of you are fine.

This time I have an issue about the HTTP Methods, a client, run some vulnerabilties test in QV Server, and found some non safe methods (PUT, DELETE, TRACE, OPTIONS, MKDIR, CONNECT, RMDIR, PROPATCH, COPY, LOCK)

he ask me if we can close it or disable it.

Does QVWS, use those methods ? if so, does exist a Qliktech technical document, that support the use of those. ?

Or how can I disable that methods.!?

Actually, we are using Qlikview Web server.

Any help , will be appreciate it.

Thanks in advance.

Karim

Re: HTTP Methods

danielrozental — Tue, 29 Jan 2013 17:20:27 GMT

You should probably try using IIS as a webserver as it will probably be easier to configure.

Re: HTTP Methods

Tue, 29 Jan 2013 17:27:57 GMT

It seems that sending an http request to qlikview webserver with another verb than GET or POST always results in "<result><message text='Empty Request'/></result>" responses.

I do not understand what you want to do, how could that be a security problem?

Re: HTTP Methods

Tue, 29 Jan 2013 23:04:41 GMT

Thanks,

I can't back, and install IIS, because the client doesn't want it.

The IT security department ran a test and wrote me this,

Insecure HTTP methods like PUT, DELETE, TRACE, OPTIONS, MKDIR, CONNECT, RMDIR, PROPATCH, COPY, LOCK. Are enabled. Or at least one of them.

Vulnerability risks.

"the attacker could use any of these HTTP methods to query, create, delete files within the server, as well as the ability to upload a file Shell and complete information about the server."

Re: HTTP Methods

rwunderlich — Wed, 30 Jan 2013 00:12:01 GMT

It sounds like a boilerplate security review question. I would ask support or your salesep for the "standard response" from Qliktech.

As jgeorge pointed out, usng any other verb does nothing useful and returns a standard result. The IT security dept is probably reacting to the fact that the server did not reject those requests. But they overlooked the fact the server does nothing useful with those requests.

-Rob

Re: HTTP Methods

Anonymous — Fri, 26 Jun 2015 07:13:16 GMT

Did u get correct solution? Anybody?

Re: HTTP Methods

Anonymous — Fri, 26 Jun 2015 07:26:05 GMT

QlikTech has given any response to this topic?