IIS 7.5 + enable PUT and DELETE for RESTFul service, extensionless
Asked Answered
C

15

59

i am trying to understand how IIS 7.5 handles POST and PUT request.

I am writing a RESTful service using OpenRasta framework. The POST operation works without any problem, but the PUT operation for the same URL does not. It returns error like the following

Detailed Error Information
Module: IIS Web Core
Notification: MapRequestHandler
Handler: StaticFile
Error Code: 0x80070002

the url is like this following "http://localhost/MyService/Resource.Something.manifest"

Same setup works fine in visual studio development IIS.

Solution

Basically the default ExtensionlessUrlHandler does not accept PUT and DELETE verb. Just need to add them.

<add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" modules="IsapiModule" scriptProcessor="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
Conger answered 18/7, 2011 at 20:38 Comment(0)
S
84

To get PUT and DELETE to be accepted by IIS 7.5 for a PHP 5.4 fast-CGI driven REST API I had to disable the WebDAV-module. Otherwise the WebDAV module intervenes the HTTP requests using PUT or DELETE. To get this working was however a bit confusing and I might have missed some steps or done it in another order.

These lines are placed as children of the <system.webServer>-element in web.config in the application root.

<modules>
    <remove name="WebDAVModule" />
</modules>
<handlers>
    <remove name="WebDAV" />
</handlers>

Hopes this might spare some frustration. It seems like the default setting for the server is to accept any HTTP verb not listed - see settings under Request filtering -> HTTP Verbs -> Edit feature Settings. One may consider to explicitly add the VERBS that are to be allowed. The verbs allowed may be specified appending this snippet, also as a child of <system.webServer>.

    <security>
        <requestFiltering>
            <verbs allowUnlisted="false">
                <add verb="GET" allowed="true" />
                <add verb="POST" allowed="true" />
                <add verb="DELETE" allowed="true" />
                <add verb="PUT" allowed="true" />
            </verbs>
        </requestFiltering>
    </security>

On a client machine one can uninstall the WebDAV module from here:

Control Panel -> Uninstall Program -> Turn Windows features on or off -> IIS -> World Wide Web Services -> Common HTTP feautre -> WebDAV Publishing

The last measure to get it working was by editing applicationhost.config found in C:\Windows\System32\inetsrv\config. Within <system.webServer> -> <handlers> you will see a php entry that has just verb="GET,HEAD,POST - amend it to add the verbs you require, e.g.:

<add name="PHP54_via_FastCGI" path="*.php" verb="GET,HEAD,PUT,DELETE,POST"/>
                                                                 |
                                                                 |
                                                                 |
append verbs here  ----------------------------------------------|
Schizo answered 29/4, 2013 at 9:53 Comment(5)
Hi Jon, this sorted my issue, I just specifically allowed the verbs and removed the webdav module....Emendate
Removing the WebDAV handler is suggested in many forums and posts, and was not enough to solve my problem. Removing the WebDAVModule did the trick. Thanks a lot!Otilia
Damn you WebDAV! :D Thanks for that tipPlassey
i was searching for this answer for last 10 days :)Cyd
I just add this in webconfig <modules> <remove name="WebDAVModule" /> </modules> <handlers> <remove name="WebDAV" /> </handlers>Evita
E
33

1.Go to IIS Manager.
2.Click on your app.
3.Go to "Handler Mappings".
4.In the feature list, double click on "WebDAV".
5.Click on "Request Restrictions".
6.In the tab "Verbs" select "All verbs" .
7.Press OK.

Excide answered 5/2, 2015 at 13:16 Comment(3)
In my case, setting WebDAV to All Verbs brought down a legacy application that was being accessed across the nation. This didn't work for me at all. We had to remove WebDAV completely as a handler mapping in order to get the application working again.Globeflower
This solution had the side effect that Visual Studio's debugging did not work anymore, but threw a 405 error.Localize
Idk .. my problem is with PUT requests being blocked, and PUT was already on the permitted listForedate
W
11

See http://learn.iis.net/page.aspx/901/iis-express-faq/ that is linked from the OR wiki.

From the link (not block-quoted for readability):

A: You can modify the IIS Express applicationHost.config in the %userprofile%\documents\IISExpress\config folder. For example to enable PUT and DELETE for extensionless Urls scroll down to the bottom of the IIS Express applicationHost.config file and look for a handler entry that starts with:

<add name="ExtensionlessUrl-Integrated-4.0"

In the verb attribute add PUT and DELETE so the verb attribute looks like: verb="GET,HEAD,POST,DEBUG,PUT,DELETE".

Wraparound answered 15/8, 2011 at 11:9 Comment(0)
S
10

My scenario was a web application in a web site on IIS 7.5. The web site had to continue to enable WebDAV, but the web application needed to turn it off in order to support PUT and DELETE in its REST API.

To get that working, the web application's Web.config needed this:

<modules runAllManagedModulesForAllRequests="true" runManagedModulesForWebDavRequests="true" >
  <remove name="WebDAVModule" />
</modules>

<handlers>
  <remove name="WebDAV" />
</handlers>

The important difference from the other answers here is the need for runManagedModulesForWebDavRequests="true"

Scarificator answered 17/6, 2016 at 3:10 Comment(1)
Actually, I think the difference (and key part that worked for me) is the <remove name="WebDAVModule" /> partUnquiet
B
7

For me this does the trick in the web.config.

<system.webserver>
    <handlers>
          <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
          <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" modules="IsapiModule" scriptProcessor="c:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />

          <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
          <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
<system.webserver/>

<system.web>
  <authentication mode="Windows" />
  <identity impersonate="true"/>
<system.web/>

I used following configuration:

  • IIS 7.5
  • Windows Server 2008 R2
  • Custom Application Pool, .NET 4.0, Integrated
  • Windows Authentication = true
  • Anonymous Authentication = false

Hope it helps. ;-)

Brachiopod answered 13/8, 2013 at 14:26 Comment(0)
N
6

URLScan tool users

If other answers still don't work and you get 404 error: these verbs may be explicitly rejected by the URLScan tool, if you have it installed.

You can configure [AllowVerbs] and [DenyVerbs] sections of the URLScan.ini file to meet your needs.

Beware of the security risks of enabling these verbs.

Nomarch answered 5/1, 2014 at 16:8 Comment(0)
T
5

What worked for me was uninstalling WebDav completely.

Tyrannicide answered 11/4, 2014 at 17:19 Comment(0)
T
5

Going into the handler mappings and setting WebDAV to handle all verbs is the only thing that worked for me, despite the fact that PUT and DELETE were already listed as handled verbs. The working web.config I have is:

  <system.webServer>
    <handlers>     
      <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
      <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
      <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
      <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
      <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
      <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
      <remove name="WebDAV" />
      <add name="WebDAV" path="*" verb="*" modules="WebDAVModule" resourceType="Unspecified" requireAccess="None" />
    </handlers>
  </system.webServer>
Torrell answered 16/7, 2014 at 21:27 Comment(0)
Q
3

in the web.config

<system.webServer>
    <handlers>
        <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
        <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
</system.webServer>

you can also use the IIS management UI and define this globally, or default web server

Quartern answered 20/7, 2012 at 17:21 Comment(0)
C
3

I tried in IIS 8.

  • **uninstall WebDav Publishing

    Steps to uninstall -> Control Panel -> Go to Programs and features -> Turn windows featues on or off-> Select Internet Information Services->World Wide Web Services->Common HTTP Featues->"Remove" WebDAV Publishing by unchecking WebDAV option**

Cactus answered 9/7, 2014 at 6:8 Comment(0)
U
2

Reason for 500 error !

Hi all,

I want to post my own research too, I hope it would help future enthusiasts. As suggested in answers, I can't uninstall WebDav so I have added the line below in web config (from other answers)

 <system.webServer>
    <handlers>
        <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
        <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
</system.webServer>

but I got a 500 error, when I have enabled debug mode found this

 Cannot add duplicate collection entry of type 'add' with unique key attribute 'name' set to 'ExtensionlessUrlHandler-Integrated-4.0'

Answer

Its because there was already an ExtensionlessUrlHandler in the handler mappings section, do the following to resolve the issue.

Method 1

1) Go to Your IIS Manager and select your app

2) Go to Handler Mappings feature

3) Find ExtensionlessUrlHandler-Integrated-4.0 and delete it.

4) Add ExtensionlessUrlHandler in your webconfig (as mentioned in above answers)

<system.webServer>
<handlers>
    <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
    <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>

Method 2

1) Remove ExtensionlessUrl handler from your web config

2) Click on your app in IIS Server, go to HandlerMappings

3) Find ExtensionlessUrlHandler-Integrated-4.0 (only this name, ignore others)

4) right click on it and choose Edit

edit handler

5) click on 'Request Restrictions' and select Verbs tab & choose All Verbs

this will enable extensionsless handler to allow all verbs.

I will go with method 1, as we can have control in web.config. But make sure you check the deployment server for duplicate handler definitions.

Unsupportable answered 16/9, 2017 at 19:53 Comment(0)
M
1

In windows server 2012. Open applicationHost.config file in notepad with Administrator rights

applicationHost.config file is found in C:\Windows\System32\inetsrv\config

Locate the section

 <verbs allowUnlisted="false" applyToWebDAV="true">
   <add verb="GET" allowed="true" />
   <add verb="HEAD" allowed="true" />
   <add verb="POST" allowed="true" />
   <add verb="DELETE" allowed="false" />
   <add verb="TRACE" allowed="false" />
   <add verb="PUT" allowed="false" />
   <add verb="OPTIONS" allowed="false" />
</verbs>

Notice DELETE and PUT HTTP Verbs are set to false. Change them to true.

It should now read as below

 <verbs allowUnlisted="false" applyToWebDAV="true">
   <add verb="GET" allowed="true" />
   <add verb="HEAD" allowed="true" />
   <add verb="POST" allowed="true" />
   <add verb="DELETE" allowed="true" />
   <add verb="TRACE" allowed="false" />
   <add verb="PUT" allowed="true" />
   <add verb="OPTIONS" allowed="false" />
</verbs>

Save the file. You have enabled HttpPut and HttpDelete requests on your web server

Mulct answered 14/2, 2016 at 15:44 Comment(1)
My problem is same. I tried all the solutions and your also but not worked for me.Pessary
A
1

My web.config with asp.net core 1.0

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
    <modules>
      <remove name="WebDAVModule" />
    </modules>
    <handlers>
      <remove name="WebDAV" />
      <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified"/>
    </handlers>
    <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="false"/>
  </system.webServer>
</configuration>
Athome answered 21/10, 2017 at 19:50 Comment(0)
S
0

The main solution is to remove webdavmodule from the specific website'd module's section.

So you can do it from both IIS and in webconfig.

Slam answered 7/12, 2021 at 18:12 Comment(0)
S
0

I was dealing with the same problem. The solution for me was to turn off the Firewall mode of the Web Application in Plesk Panel.

enter image description here

Subtle answered 29/12, 2021 at 16:1 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.