2

I have an IIS/MVC.Net application that has recorded thousands of action-not-found exceptions. When I investigated these it appears that they are all HTTP OPTIONS requests to an MVC action that only supports GET.

This action allows caching and returns minified CSS or JS content. Within the application it's accessed by <link> and <script> tags in the <head>. The application is not making the requests and we haven't seen this in testing with any browser.

What application is making all these OPTIONS requests?

What is it expecting in return?

Keith
  • 150,284
  • 78
  • 298
  • 434
  • `Http Options` will be made specifically when you have `CORS` requests, please check if you have any other different domain site making requests to some of your domain content or files. – ramiramilu Jan 14 '16 at 09:28
  • This is an HTTPS site with `X-Frame-Options=SAMEORIGIN`,`X-Content-Type-Options=nosniff` and `Strict-Transport-Security` enabled. No browser should make cross-origin requests to this application. – Keith Jan 14 '16 at 09:32
  • Try logging the referrer and the user agent to infer the offender. Maybe it is just something like [this trouble](http://stackoverflow.com/q/8073908/1178314). – Frédéric Jan 14 '16 at 09:41
  • 1
    @Frederic ah, that could be it - the user agent is `Microsoft Office Protocol Discovery` – Keith Jan 14 '16 at 09:44

1 Answers1

3

As stated here, an usual case triggering those Microsoft Office Protocol Discovery queries are mails including images hosted on your server and viewed with Outlook (MS Office Outlook, not Outlook Express).

That does trigger OPTIONS request, as if it was trying to check if the server has some webdav support. I speculate MS Office does that for enabling integration with Sharepoint, by example.

So I usually consider it is only some annoying noise.

If you host mail images on your MVC app IIS site, maybe could you consider to move them on a dedicated static IIS site. Of course, as you cannot change previously sent mails, you may have to maintain old images and you will continue to have those requests till users cease to open old mails. Otherwise you may have to tweak your logging logic to lower the log level of those noisy requests.

Community
  • 1
  • 1
Frédéric
  • 9,364
  • 3
  • 62
  • 112