Finding: Insecure HTTP Method –DELETE

> The insecure HTTP method [DELETE] is enabled on the web server for this resource. Depending on the web server configuration, and the underlying implementation responsible for serving the resource, this might or might not be exploitable. The TRACK and TRACE methods may be used by an attacker, to gain access to the authorisation token/session cookie of an application user, even if the session cookie is protected using the HttpOnly flag. For the attack to be successful, the application user must typically be using an older web browser, or a web browser which has a Same Origin Policy (SOP) bypass vulnerability. The CONNECT method can be used by a web client to create an HTTP tunnel to third party websites or services.

> Recommendation: Disable insecure methods such as TRACK, TRACE, and CONNECT on the web server, and ensure that the underlying service implementation does not support insecure methods.

This finding requires consideration of how Strapi responds to the `DELETE` method.

Start by reviewing how the Strapi service responds to DELETE, then inspect the web server configuration and any relevant deployment entry points. Determine whether DELETE, TRACK, TRACE, or CONNECT are supported and document whether the finding is exploitable. Done means the response is assessed and insecure methods are disabled where appropriate.

Written by the indexing model from the issue text.