ASP.NET Web API - PUT & DELETE Verbs Not Allowed - IIS 8

Question

I recently upgraded from Visual Studio 2010 to the Visual Studio 2012 RC. The installer also installs IIS 8 Express which Visual Studio now uses as the default web server.

IIS 8 is blocking my WEB API requests that use PUT AND DELETE verbs. IIS returns a 405 error, The requested resource does not support http method 'PUT'.

I know people have issues with this in the past and there are several messages about it on Stack Overflow. With IIS 7 Express the solution was to uninstall WebDav. Unfortunately I don't see any way to do that with IIS 8.

I've tried editing out the WebDav sections from applicationhost.config but that hasn't helped. For example I removed <add name="WebDAVModule" image="%IIS_BIN%\webdav.dll" /> from the config file.

I've spent far too long on this. There must be a simple way to enable PUT and DELETE?

Uncaredfor

This still broken in the RTM version. Just wasted 3 hours on this... All that was needed was to add the extra verbs to ExtensionlessUrl-Integrated-4.0. – Metal

I don't think this is broken but is by design. I think changing the default behavior would interfere with WebDAV and break backwards compatibility. This also didn't work with IIS7 when WebDAV was installed. – Uncaredfor

I also just wasted 3 hours on this... 6 years after this post. – Mosira

please look at https://mcmap.net/q/151834/-asp-net-web-api-405-http-verb-used-to-access-this-page-is-not-allowed-how-to-set-handler-mappings – Miliary

Everyone! Ignore @Miliary post if you're using latest VS to date. It'll break your .net core project – Shagreen

Answer 1

Okay. I finally got to the bottom of this. You need to jump through some hoops to get the PUT and DELETE verbs working correctly with IIS8. In fact if you install the release candidate of VS 2012 and create a new WEB API project you'll find that the sample PUT and DELETE methods return 404 errors out of the box.

To use the PUT and DELETE verbs with the Web API you need to edit %userprofile%\documents\iisexpress\config\applicationhost.config and add the verbs to the ExtensionlessUrl handler as follows:

Change this line:

<add name="ExtensionlessUrl-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />

to:

<add name="ExtensionlessUrl-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />

In addition to the above you should ensure WebDAV is not interfering with your requests. This can be done by commenting out the following lines from applicationhost.config.

<add name="WebDAVModule" image="%IIS_BIN%\webdav.dll" />
<add name="WebDAVModule" /> 
<add name="WebDAV" path="*" verb="PROPFIND,PROPPATCH,MKCOL,PUT,COPY,DELETE,MOVE,LOCK,UNLOCK" modules="WebDAVModule" resourceType="Unspecified" requireAccess="None" />

Also be aware that the default Web API convention is that your method name should be the same as the invoked HTTP verb. For example if you're sending an HTTP delete request your method, by default, should be named Delete.

Uncaredfor

For similar problems with OPTIONS verb on IIS8 (where something else is intercepting before your handlers) try <remove name="OPTIONSVerbHandler"/> in your web.config. For that matter, I would advise using the "remove" technique in your local web.config over messing with applicationhost.config when possible as a general rule – Marandamarasca

Instead of removing WebDAV at server level which may have knock-on effects it is better to remove it from your project as shown here: https://mcmap.net/q/151834/-asp-net-web-api-405-http-verb-used-to-access-this-page-is-not-allowed-how-to-set-handler-mappings – Sweeten

And then what? May be even it will work locally but won't work on Azure – Gurtner

An answer that instructs to modify system settings, even on dev machines, can't be an answer. This solves a symptom and does not really helps on teams and on production. Will you replicate this on every machine? Check out Santosh Sah answer. – Chun

In addition, I also needed to remove the WebDAVModule from the modules section, as per Santosh Sah's answer. – Diaconicum

Unfortunately, this didn't work for me. I'm using IIS8.5, any other leads please? :( – Zarah

Using IISExpress 10 with VS 2015 Community, the WebDAV settings were already commented out, but I had to make the "ExtensionlessUrl-Integrated-4.0" verb changes. I was stumped for hours till this post, I thought I was doing PUT wrong. How I laughed when I found out it was Microsoft all along... – Bakki

I just came across this answer after searching for a full day (10 hours). It's quite elegant - creating a custom handler that inherits from the existing SimpleHandlerFactory handler. https://mcmap.net/q/151835/-http-error-405-0-method-not-allowed-in-iis-express Enjoy! – Marandamarasca

Isn't there any way to make this change locally so it only applies to a single folder? People might want to allow PUT verbs on url.com/api/ but not on the rest of the site. – Stephi

Why would editing the IIS Express configuration have ANY effect on IIS? -- They are two different products. Unfortunately, this will only work in your local dev. environment; the web.config solution below is what you need for IIS. – Carpetbag

This worked for me although I'm using IIS, not IIS Express, so the path to the config file for me was: C:\Windows\System32\inetsrv\Config\applicationHost.config – Hymenopterous

Answer 2

Change Your Web.Config file as below. It will act like charm.

In node <system.webServer> add below portion of code

<modules runAllManagedModulesForAllRequests="true">
  <remove name="WebDAVModule"/>
</modules>

After adding, your Web.Config will look like below

<system.webServer>
    <validation validateIntegratedModeConfiguration="false" />
    <modules runAllManagedModulesForAllRequests="true">
        <remove name="WebDAVModule"/>
    </modules>
    <httpProtocol>
    <customHeaders>
        <add name="Access-Control-Allow-Origin" value="*" />
        <add name="Access-Control-Allow-Headers" value="Content-Type" />
        <add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS" />
    </customHeaders>
    </httpProtocol>
    <handlers>
      <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
      <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
      <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
      <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
      <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
      <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
</system.webServer>

Casteel

Removing WebDavModule is the correct way of getting aroung this issue. – Spermous

Saved my day: <modules runAllManagedModulesForAllRequests="true"> <remove name="WebDAVModule"/> </modules> – Buenrostro

Custom headers shouldn't be needed as they're related to CORS and this way you're inducing to a security hole. Just the part regarding WebDAVModule is relevant. – Chun

This answer is correct with the only exception that the handler name may differ across IIS versions - for instance 7.5 uses "ExtensionlessUrlHandler-Integrated-4.0" (as in above answer) while IIS 8.5 has this renamed to "ExtensionlessUrl-Integrated-4.0" (also mentioned by Mark S. The name of the handler is shown in the IIS error page, once you receive the error, so it should be trivial to know which to set. I use both names in order to support different hosting environments. – Diaconicum

This helped me enable PUT and DELETE methods on Plesk. Thanks – Slain

It makes me die a little inside everytime I see this - runAllManagedModulesForAllRequests="true" - as a solution britishdeveloper.co.uk/2010/06/… – Iceboat

Thanks! This is still super helpful in March 2016! – Buckie

CAUTION : The custom headers section in the above code allows ANY site to call your API from a browser - which is a big security risk. Read up on CORS, which is effectively what those headers are enabling. – Sisco

@profMamba, answer is not related to CORS. Of course, you can configure "Access-Control-Allow-Origin" to allow your domains. – Casteel

Worked like a charm for me. Thanks. – Walton

this help me for put an delete after remove <modules runAllManagedModulesForAllRequests="true"> <remove name="WebDAVModule"/> </modules> in vs2015 in win10 – Prong

I get a 500 internal error after making this change. – Spielman

@JesseBarnum, please debug and let me know error detail. Above fix itself does not cause any interval server error. – Casteel

This worked like a charm for me in VS 2017 and IIS 10 (help -> about in inetmgr says it's version 10, not sure if that's accurate. Might just be the tool version. Anyway, it's whatever comes built-in to Windows 10). – Carpetbag

this worked for me, I had to change it on a hosting, only can work in my web.config – Irenairene

adding this parameter made the change "runAllManagedModulesForAllRequests" it works now – Soberminded

Answer 3

Remove the WebDAV works perfectly for my case:

<modules>
  <remove name="WebDAVModule"/>
</modules>
<handlers>
  <remove name="WebDAV" />
  <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
  <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" 
       type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>

it always better to solve the problem through the web.config instead of going to fix it through the iis or machine.config to grantee it wouldn't happen if the app hosted at another machine

Righthanded

This worked for me, where the others didn't for some reason (was on IIS 8.5 ) thanks – Chiffchaff

Remove WebDAVModule worked for me, no need to remove handler WebDAV (IIS 8.0). – Orcein

just removing webdav works on framework 4.6.2 iis8.5 – Anthea

Answer 4

Update your web.config

  <system.webServer>
    <modules>
      <remove name="WebDAVModule"/>
    </modules>
    <handlers>
      <remove name="WebDAV" />
      <remove name="ExtensionlessUrl-Integrated-4.0" />
      <add name="ExtensionlessUrl-Integrated-4.0"
           path="*."
           verb="GET,HEAD,POST,DEBUG,DELETE,PUT"
           type="System.Web.Handlers.TransferRequestHandler"
           preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
  </system.webServer>

http://odetocode.com/blogs/scott/archive/2012/08/07/configuration-tips-for-asp-net-mvc-4-on-a-windows.aspx

Removes the need to modify your host configs.

Verticillaster

I was already written other line but it was not working. after adding lines <remove name="WebDAVModule"/> and <remove name="WebDAV" /> it is working now. Thanks a lot & 1 up vote from my side. – Tardif

This works, but may fail due to configuration locking preventing the use of <modules> in web.config. In this case, you have to disable the configuration lock in applicationHost.config. If you don't have control over applicationHost.config for some reason, then this approach cannot be used. – Mcauley

Worked with IIS10, though I just used "*" as verb – Breland

Worked with IIS 10 and Web API 2. Worked, I should add, after another dozen "solutions" I found online did not. Thanks! – Heptavalent

Might be obvious to some, but it wasnt' to me: make sure you're using the integrated pipeline and not classic, or this won't help. – Irreducible

This should be the accepted solution. I don't wanna mess with the central system settings to deploy my API. I was missing the WebDAV handler in addition to the module removal. Also my Web.config had other handlers specified than the one you did here. I added this one as well just to be sure, and now it works. – Theophany

Answer 5

In Asp.Net Web API - webconfig. This works in all browser.

Add the following code inside the System.web tag

<webServices>
  <protocols>
    <add name="HttpGet"/>
    <add name="HttpPost"/>
  </protocols>
</webServices>

Replace your system.webserver tag with this below code

<httpProtocol>
  <customHeaders>
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE" />
    <add name="Access-Control-Allow-Headers" value="Content-Type" />
  </customHeaders>
</httpProtocol>
<modules runAllManagedModulesForAllRequests="false">
  <remove name="WebDAVModule" />
</modules>

<validation validateIntegratedModeConfiguration="false" />
<handlers>
  <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
  <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
  <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
  <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
  <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

  <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />

</handlers>

Zurek

I had this problem in IIS 7.5, and this fix worked perfectly. Instead of deleting all of my system.webserver content, I just merged the relevant settings above into my own settings. – Edgington

CAUTION : The custom headers section in the above code allows ANY site to call your API from a browser - which is a big security risk. Read up on CORS, which is effectivly what those headers are enabling. – Sisco

Also had this issue on iis 7.5 and this worked. Be sure to read Toolkit's message above about the risk involved in opening up cors to everyone. Also upvote his comment because tidbits like that a very valuable. – Linnet

I don't think you need custom headers at all in this case. The rest of the system.webserver section should suffice - just make sure you have the right name for the extensionless url handler. – Diaconicum

@Sisco So how are we supposed to deploy a PUT web service securely if we do not do this?! – Buskin

@Buskin You should allow only trusted sites to Access-Control-Allow-Origin i.e. replace "*" with your website(s) URL. This property is a white list of all trusted sites, unless you want to trust the entire web (which is typically a bad idea). – Sisco

Finally, after much grief, this worked for me on a bastardized corporate pc. Windows 7. Visual Studio 2013. Thanks! – Consuetudinary

Customheaders fixed the issue for .net core on IIS 10 on Windows Server 2016. Thanks! – Rumple

Answer 6

Enable CORS (nice and neat)

1.Add CORS nuget package

Install-Package microsoft.aspnet.webapi.cors

2.in the WebApiConfig.cs file to Register method add bellow code :

config.EnableCors();

ex:
using System.Web.Http;

namespace test
{
public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        // Web API configuration and services


        config.EnableCors(); //add this**************************


        // Web API routes
        config.MapHttpAttributeRoutes();

        config.Routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: "api/{controller}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );           
    }
}
}

3.Add bellow code into namespace of the controller include get,post,delete,put or any http method

[EnableCors(origins: "The address from which the request comes", headers: "*", methods: "*")]

ex:

using System.Web.Http.Cors;//add this******************************
namespace Test.Controllers
{
[EnableCors(origins: "http://localhost:53681/HTML/Restaurant.html", headers: "*", methods: "*")]
public class RestaurantController : ApiController
{
    protected TestBusinessLayer DevTestBLL = new TestBusinessLayer();

    public List<Restaurant> GET()
    {
        return DevTestBLL.GetRestaurant();
    }

    public List<Restaurant> DELETE(int id)
    {
        return DevTestBLL.DeleteRestaurant(id);
    }       
}
}

reference :http://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api

Sainted

Answer 7

this worked for me on iis8 together with some of the other answers. My error was a 404.6 specifically

<system.webServer>
  <security>
  <requestFiltering>
    <verbs applyToWebDAV="false">
       <add verb="DELETE" allowed="true" />
    </verbs>
  </requestFiltering>
  </security>
</system.webServer>

Dwell

when you run AppCmd, this is what in puts in your web.Config (except for the applyToWebDAV bit). – Inadequate

Answer 8

Just a quick update for anyone else who might run into this issue. As of today, changing the %userprofile%\documents\iisexpress\config\applicationhost.config does NOT work any longer (this was working fine until now, not sure if this is due to a Windows update). After hours of frustration, I changed the web.config to add these handlers to system.webserver to get it to work:

<handlers>
        <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
        <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
        <remove name="ExtensionlessUrlHandler-Integrated-4.0" />

        <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
        <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
        <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>

Ohg

Answer 9

For PHP, it was simply:

1. Open IIS
2. Go to Handler Mappings
3. click edit on php5.6.x or php7.0.x
4. click "request restrictions"
5. under the verbs tab, select "one of the following verbs" and add "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS"

I imagine this will work with other handlers too.

Costume

Answer 10

After nothing worked, I was able to solve this by below steps:

• Did not select ‘WEB DAV PUBLISHING’ IIS settings, while installing IIS. • INETMGR - Default Website – Request Filtering – HTTP Verbs – PUT as True

Topheavy

Answer 11

After endless searching and trying the already supplied answers (adding the PUT,DELETE verbs and remove WEBdav) it just didn't work.

I went to IIS logging settings: > View Log Files. In my case W3SVC4 was the folder with the latest date, opened the folder, looked up the latest log file and saw this entry: GET /Rejected-By-UrlScan ~/MYDOMAIN/API/ApiName/UpdateMETHOD

The Update method was listed with verb GET, weird right? So I Googled for Rejected-By-UrlScan and found this link: UrlScan Broke My Blog.

I went to here: %windir%\system32\inetsrv\urlscan\UrlScan.ini

Basically, the UrlScan blocked PUT and DELETE verbs. I opened this INI file, added the PUT and DELETE to the AllowVerbs and removed them from the DenyVerbs listings. I saved the INI file and it worked! So for me these steps were necessary next to the ExtensionlessUrlHandler hints.

Windows Webserver 2008 R2 (64 bit), IIS 7.5. I'm using this in combination with DotNetNuke (DNN) WebAPI. ASP.Net 4.0 My update method:

[HttpPut]
[DnnAuthorize(StaticRoles = "MyRoleNames")]
public HttpResponseMessage UpdateMETHOD(DTO.MyObject myData)

Grit

Answer 12

I have faced the same issue with you, then solved it, Here are solutions, I wish it maybe can help
First

In the IIS modules Configuration, loop up the WebDAVModule, if your web server has it, then remove it

Second

In the IIS handler mappings configuration, you can see the list of enabling handler, to choose the PHP item, edit it, on the edit page, click request restrictions button, then select the verbs tab in the modal, in the specify the verbs to be handle label, check the all verbs radio, then click ok, you also maybe see a warning, it shows us that use double quotation marks to PHP-CGI execution, then do it

if done it, then restart IIS server, it will be ok

Caprification

I only removed WebDAVModule from IIS website and that worked for me – Frangipani

Answer 13

Besides all above solutions, check if you have the "id" or any custom defined parameter in the DELETE method is matching the route config.

public void Delete(int id)
{
 //some code here
}

If you hit with repeated 405 errors better reset the method signature to default as above and try.

The route config by default will look for id in the URL. So the parameter name id is important here unless you change the route config under App_Start folder.

You may change the data type of the id though.

For example the below method should work just fine:

public void Delete(string id)
{
 //some code here
}

Note: Also ensure that you pass the data over the url not the data method that will carry the payload as body content.

DELETE http://{url}/{action}/{id}

Example:

DELETE http://localhost/item/1

Hope it helps.

Passe

Answer 14

Here is how you allow extra HTTP Verbs using the IIS Manager GUI.

1. In IIS Manager, select the site you wish to allow PUT or DELETE for.

2. Click the "Request Filtering" option. Click the "HTTP Verbs" tab.

3. Click the "Allow Verb..." link in the sidebar.

4. In the box that appears type "DELETE", click OK.

5. Click the "Allow Verb..." link in the sidebar again.

6. In the box that appears type "PUT", click OK.

Ashti

nice try - something different for once - but still didnt work! – Tamikotamil

I had tried everything else I've seen suggested on SO and elsewhere. I finally tried this and it worked perfectly. In my case, the PUT and DELETE verbs were already in the list, and I had to first remove them, then add them back using the Allow Verb... link, but still, it worked when nothing else had. Thank you so much! – Olathe

Answer 15

I am using an ashx file in an MVC application and none of the above answers worked for me. IIS 10.

Here's what did work. Instead of changing "ExtensionlessUrl-Integrated-4.0" in IIS or web.config I changed "SimpleHandlerFactory-Integrated-4.0" for "*.ashx" files:

<add name="SimpleHandlerFactory-Integrated-4.0" path="*.ashx" 
verb="GET,HEAD,POST,DEBUG,PUT,DELETE" 
type="System.Web.UI.SimpleHandlerFactory" 
resourceType="Unspecified" requireAccess="Script" 
preCondition="integratedMode,runtimeVersionv4.0" />

Appreciate

Answer 16

I added requireAccess="None" to web.config like this

    <configuration>
  <location path="." inheritInChildApplications="false">
    <system.webServer>
      <handlers>
                <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
                <remove name="WebDAV" />
        <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" requireAccess="None"/>
                <add name="WebDAV" path="*" verb="PROPFIND,PROPPATCH,MKCOL,PUT,DELETE,COPY,MOVE,LOCK,UNLOCK" modules="WebDAVModule" resourceType="Unspecified" requireAccess="None" />
                <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,DELTE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" responseBufferLimit="0" />
      </handlers>
      <aspNetCore processPath=".\Informing.Gateway.Api.exe" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="InProcess" />
    </system.webServer>
  </location>
</configuration>

And It worked. That's it

Maragaret

Answer 17

Trial an error is not the correct way to fix this problem. What needs to be done is:

• To identify the source that blocks your PUT/DELETE requests
• then you can remove it, disable it or even better configure it:

1- In order to know the source , you have to configure the Failed Request Tracing in IIS. 2- You have "Add" what Errors to log Make sure you use short life span for this tracing entry to avoid overwhelming your system with log files. IIS will generate a separate xml file for each call. 3- Make the erroneous request using Postman or Swagger to generate a tracing error entry. 4- From the previous screen, you can select "View Trace Logs" to take you to the generated log files. 5- Open the erroneous log file using internet explorer. And accept any messages. 6- Notice the source that blocks your request. 7- disable it either in Modules or Mapping Handler from IIS interface or in your web.config as demonstrated by other posters.

Humiliating

Answer 18

The another reason can be the following:
I changed my Url for Web Api method according to this answer:

Url.Action("MyAction", "MyApiCtrl", new { httproute = "" })

But this method creates link like:

/api/MyApiCtrl?action=MyAction

This works correctly with GET and POST requests but not with PUT or DELETE.
So I just replaced it with:

/api/MyApiCtrl

and it fixed the problem.

Wein

Answer 19

You can convert your Delete method as POST as;

 [HttpPost]
 public void Delete(YourDomainModel itemToDelete)
 {
 }

Pseudo

Honestly this is not a bad solution in some cases. If you're deploying to many disparate clients and would prefer not to diagnose why PUT/DELETE is failing every single time (for different reasons) this circumvents the issue entirely. – Unready

Answer 20

In IIS 8.5/ Windows 2012R2, Nothing mentioned here worked for me. I don't know what is meant by Removing WebDAV but that didn't solve the issue for me.

What helped me is the below steps;

1. I went to IIS manager.
2. In the left panel selected the site.
3. In the left working area, selected the WebDAV, Opened it double clicking.
4. In the right most panel, disabled it.

Now everything is working.

Matthus

Answer 21

For those poor souls, searching for a way to get a simple aspx file handle PUT, PATCH and DELETE requests (yeah, webforms are so last century, but they are still in use). It's not removing WebDav or any of the mentioned fixes before. It's PageHandlerFactory-Integrated-4.0

This is all the magic you need to get a simple aspx file (for example log-request.aspx) accept all the verbs:

    <system.webServer>
        <handlers>
            <remove name="PageHandlerFactory-Integrated-4.0" />
            <add name="PageHandlerFactory-Integrated-4.0" path="*.aspx" verb="*" type="System.Web.UI.PageHandlerFactory" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
        </handlers>
    </system.webServer>

Bergstrom

Answer 22

I am not sure if you have edited right configuration file. Try following steps

1. open %userprofile%\ducuments\iisexpress\config\applicationhost.config

2. By default bellow given entries are commented in the applicationhost.config file. uncomment these entries.

<add name="WebDAVModule" image="%IIS_BIN%\webdav.dll" />


<add name="WebDAVModule" />

<add name="WebDAV" path="*"
 verb="PROPFIND,PROPPATCH,MKCOL,PUT,COPY,DELETE,MOVE,LOCK,UNLOCK"
 modules="WebDAVModule" resourceType="Unspecified" requireAccess="None"
 />

Commune

messing with applicationhost.config? nope – Gurtner

One should not mess with other than the application configuration file. First- you will do this for the entire server and forget, then many people will wonder how it works on this machine and doesn't work on the rest. Also, if you are not allowed access to the IIS config file on the server where the application is hosted, you will have to work it out in the web.config. Imagine your dev server has the above update, will your web.config be accurate? It is a great way to loose someone's day on investigating why the production deployment has failed – Diaconicum