[Asmod4n]

Slightly off topic Funfact: you can buy a several thousand dollars expensive ssl intercepting proxy appliance which doesn’t support anything beyond http/1.1.

Will be fun when those see a whole new http verb, I bet that leads to at least DoS by the track record of that company.

[nness]

What is the use-case for a WAF/proxy/etc. to block unknown HTTP verbs? It feels like a pathway for obsolescence with no actual security benefit?

[entuno]

Historically there have been vulnerabilities in various applications due to HTTP method tampering, and in the days of people accidentally leaving WebDAV enabled then methods like PUT and DELETE could be very damaging. Plus the issues with TRACK and TRACE.

Given that most websites only ever use a handful of methods (even once you account for REST APIs using PUT, PATCH and DELETE now), and that list very rarely changes, the WAF developers tend to look at this question from the opposite angle: when you know there are only half a dozen widely used methods, why would you allow anything else by default?

[Asmod4n]

Not block, straight out crash the process is my guess will happen here.

[Stitch4223]

Not mentioning the vendor… means your comment is true for every vendor :)

[Asmod4n]

That would be lancom. Good routers, the rest not so much.