What causes an HTTP 405 "invalid method (HTTP verb)" error when POSTing a form to PHP on IIS?

Question

I have one form in a PHP (5.2.9-1) application that causes IIS (Microsoft-IIS/6.0) to throw the following error when POSTed:

The page you are looking for cannot be displayed because an invalid method (HTTP verb) was used to attempt access.

It's an HTTP 405 status code. All other forms in the application work, so I believe that the IIS 'verbs' setting for PHP pages is correct.

This is a customer's server, which I have no access to for verifying settings or testing code. All I can do is send the customer replacement files. Other customers on IIS servers have no such issue.

The form is perfectly straightforward:

<form method="post" action="index.php">
    ... fields ... 
</form>

What can cause IIS to throw that error on one form only, but work fine on others?

score 28 · Accepted Answer · answered Sep 10 '09 at 09:50

I managed to get FTP access to the customer's server and so was able to track down the problem.

After the form is POSTed, I authenticate the user and then redirect to the main part of the app.

Util::redirect('/apps/content');

The error was occurring not on the posting of the form, but on the redirect immediately following it. For some reason, IIS was continuing to presume the POST method for the redirect, and then objecting to the POST to /apps/content as it's a directory.

The error message never indicated that it was the following page that was generating the error - thanks Microsoft!

The solution was to add a trailing slash:

Util::redirect('/apps/content/');

IIS could then resolve the redirect to a default document as is no longer attempting to POST to a directory.

score 7 · Answer 2 · edited Sep 06 '17 at 21:44

7

I am deploying VB6 IIS Applications to my remote dedicated server with 75 folders. The reason I was getting this error is the Default Document was not set on one of the folders, an oversight, so the URL hitting that folder did not know which page to server up, and thus threw the error mentioned in this thread.

edited Sep 06 '17 at 21:44

Mike G

4,232
9
40
66

answered Jun 10 '11 at 10:39

Boyd White

71
1
1

Andiih · Answer 3 · 2009-09-10T10:01:30.060

5

The acceptable verbs are controlled in web.config (found in the root of the website) in <system.web><httpHandlers> and possibly <webServices><protocols>. Web.config will be accessible to you if it exists. There is also a global server.config which probably won't. If you can get a look at either of these you may get a clue.

The acceptable verbs can differ with the content types - have you set Content-type headers in your page at all ? (i.e. if your Content-type was application/json then different verbs would be allowed)

edited Sep 10 '09 at 10:01

answered Sep 09 '09 at 15:11

Andiih

12,285
10
57
88

Unfortunately, the customer's shared hosting environment doesn't offer access to system.web/httpHandlers. – drewm Sep 10 '09 at 08:54
For clarity and those unfamiliar with .net I should have written - - this is a section within web.config, normally found in the root of the website, not a file system path. I will edit my post to reflect that, although I see you have now solved it! – Andiih Sep 10 '09 at 09:59

score 4 · Answer 4 · answered Sep 09 '09 at 15:10

4

By any chance have you tried POST vs post? This support article suggests it can cause problems with IIS: http://support.microsoft.com/?id=828726

answered Sep 09 '09 at 15:10

David Carrington

385
1
5

1

Because, according to RFC 2616 (HTTP/1.1), RFC-defined method tokens are upper-cased, and all are case-sensitive. – GZipp Sep 09 '09 at 16:16
Changing POST to uppercase didn't change the behaviour. – drewm Sep 10 '09 at 08:53
post does not differ from POST ->html is case insensitive – radu florescu Feb 09 '10 at 23:07
3

@madicemickael, "POST" is an *HTTP* verb, not *HTML*. These are different things. If you meant to say "HTTP is case-insensitive", that is also not true, because HTTP in general operates with bytes, not text. The notion of "case" only applies to text. – Constantin Mar 08 '11 at 10:04
2

The link now is dead. It is always better you copy and paste some main parts of the answer so if in future link goes down, we can know about what was it about. Thanks. – Jamshaid K. Jun 11 '19 at 00:22
1

Only confirm that this has been my case. API developers have used `POST` for adding new data to their system, but have used `put` for updating previously added data. Really annoying problem until I read this answer. – EAmez Jul 05 '19 at 12:03

score 2 · Answer 5 · edited Mar 01 '12 at 15:28

2

I don't know why but its happened when you submit a form inside a page to itself by the POST method.

So change the method="post" to method="get" or remove action="anyThings.any" from your <form> tag.

edited Mar 01 '12 at 15:28

Mark Ursino

31,209
11
51
83

answered Feb 29 '12 at 19:26

Bobby

29
1

2

Do you know what is the difference between `post` and `get`? bad suggestion. – Rafael Herscovici Jul 28 '13 at 10:08

score 1 · Answer 6 · answered Sep 09 '09 at 14:56

It sounds like the server is having trouble handling POST requests (get and post are verbs). I don't know, how or why someone would configure a server to ignore post requests, but the only solution would be to fix the server, or change your app to use get requests.

score 1 · Answer 7 · answered Aug 10 '18 at 18:51

1

We just ran into this same issue. Our Cpanel has expanded from PHP only to PHP and .NET and defaulted to .NET.

Log in to you Cpanel and make sure you don’t have the same issue.

answered Aug 10 '18 at 18:51

Sam Monem

11
1

score 0 · Answer 8 · answered Apr 03 '14 at 09:49

I had this issue with a facebook application that I was developing for a fan page tab. If anyone faces this issue with a facebook application then

1-goto https://developers.facebook.com

2-select the application that you are developing

3-make sure that all the link to your application has tailing slash /

my issue was in the https://developers.facebook.com->Apps->MYAPPNAME->settings->Page Tab->Secure Page Tab URL, Page Tab Edit URL, Page Tab URL hope this will help

score 0 · Answer 9 · answered Sep 11 '14 at 08:40

As drewm himself said this is due to the subsequent redirect after the POST to the script has in fact succeeded. (I might have added this as a comment to his answer but you need 50 reputation to comment and I'm new round here - daft rule IMHO)

BUT it also applies if you're trying to redirect to a page, not just a directory - at least it did for me. I was trying to redirect to /thankyou.html. What fixes this is using an absolute URL, i.e. http://example.com/thankyou.html

score 0 · Answer 10 · answered Feb 25 '15 at 19:53

0

i had to change my form's POST to a GET. i was just doing a demo post to an html page, on a test azure site. read this for info: http://support.microsoft.com/kb/942051

answered Feb 25 '15 at 19:53

captainhero70

694
6
8

score -4 · Answer 11 · answered Sep 08 '15 at 16:43

An additional possible cause.

My HTML page had these starting tags:

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">

This was on a page that using the slick jquery slideshow.

I removed the tags and replaced with:

<html>

And everything is working again.

What causes an HTTP 405 "invalid method (HTTP verb)" error when POSTing a form to PHP on IIS?

11 Answers11

Linked