disable TRACE method

src/http/ngx_http_parse.c

diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index 135208e..6d0f848 100644
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -146,6 +146,12 @@
                         r->method = NGX_HTTP_MKCOL;
                     }
 
+                    if (m[0] == 'T' && m[1] == 'R'
+                        && m[2] == 'A' && m[3] == 'C' && m[4] == 'E')
+                    {
+                        r->method = NGX_HTTP_TRACE;
+                    }
+
                     break;
 
                 case 6:

src/http/ngx_http_request.c

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index afc1d64..1a2e1bc 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1267,6 +1267,13 @@
         return NGX_ERROR;
     }
 
+    if (r->method & (NGX_HTTP_TRACE)) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent TRACE method");
+        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
+        return NGX_ERROR;
+    }
+
     if (r->headers_in.transfer_encoding
         && ngx_strstr(r->headers_in.transfer_encoding->value.data, "chunked"))
     {

src/http/ngx_http_request.h

diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h
index 787b361..939e169 100644
--- a/src/http/ngx_http_request.h
+++ b/src/http/ngx_http_request.h
@@ -37,6 +37,7 @@
 #define NGX_HTTP_PROPPATCH                 0x0800
 #define NGX_HTTP_LOCK                      0x1000
 #define NGX_HTTP_UNLOCK                    0x2000
+#define NGX_HTTP_TRACE                     0x4000
 
 #define NGX_HTTP_CONNECTION_CLOSE          1
 #define NGX_HTTP_CONNECTION_KEEP_ALIVE     2