WCF REST Service - 401 Unauthorized

Question

We're in the process of developing a WCF REST web service which just receives a bunch of arbitrary text from any anonymous user and then performs some processing on the back end.

For example, here's one method from our web service:

[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
public class MyRESTService : IMyRESTService
{
    [WebInvoke(Method = "PUT", UriTemplate = "/MyRESTMethod?paramA={paramA}&paramB={paramB}")]
    public Stream MyRESTMethod(string paramA, string paramB, Stream rawData)
    {
        //do some stuff...
    }
}

If we just use the default IIS settings we get a (401) Unauthorized. However, after much trial and error we figured out that we could get it to work by giving WRITE access to 'Everyone' on the actual .svc file for our service.

My question is: why in the world would IIS need to have WRITE access to an .svc file for this to work? Is there a better way or am I stuck with this hackish (and possibly insecure) workaround?

WTF Microsoft?

Possibly related:

• PUT and DELETE in RESTful WCF Service cause 401 Unauthorized error
• IIS7 Post/Put/Patch/Delete WCF oData - Authentication Failure 401.3

Kugler

The access rights do not necessarily need to be granted to "Everyone". Instead the authenticated user must have these rights. For anonymous access this is IUSR. – Specs

Answer 1

After talking to a tech representative from M$ I was informed that this is indeed the expected behavior. The service must have write access enabled for someone to send a request to it, and when you do this it will actually set write access automatically on the .SVC file as well.

Kugler

You saved my day! BTW: Thinking about it a second time this does kind of make sense: When you request a PUT on a resource, that resource must allow write access. Now, I guess REST with WCF is probably implemented such that IIS interprets a PUT /foobar.svc/some/path as a PUT request on /foobar.svc and forwards the "/some/path" part to WCF for further interpretation. So, for IIS this is a PUT request on /foobar.svc - in HTTP speaking: You want to modify foobar.svc – Specs

Answer 2

I have also found this can be fixed by putting

<authentication mode="None" /> inside of <system.web> in your web.config

Monger

this helped me as well, but is it safe? – Road

Depends on your environment. In my case, we were trusting the network was secure, and maybe that is sufficient. If you need direct authentication between services, obviously this will be a problem. – Monger