ASP.NET Core with IIS - HTTP Verb Not Allowed

Question

We have an ASP.NET Core 2.0 web site that also presents a couple of simple Web API methods for UI enhancement purposes.

The Web API calls work as expected when running locally under IIS Express, but when we deploy to our IIS 8.5 production web server, we get the following error when making HTTP DELETE and PUT requests...

405 Method Not Allowed

After some web searching, we have found several posts suggesting the removal of the IIS WebDAV module. We have disabled this in IIS (it is our server), and we have also tried the following:

Disabled WebDAV
Enabled WebDev and set Allow verb filtering = False
Set the Hander Mappings to allow All Verbs in the Request Restrictions settings for: aspNetCore, WebDAV and ExtensionlessUrlHandler-Integrated-4.0

None of the above steps have resolved our problem.

Any advice/direction would be much appreciated.

score 80 · Answer 1 · answered Mar 27 '18 at 19:58

80

This was what worked for me (netcore 2.0)

<system.webServer>
  <modules runAllManagedModulesForAllRequests="false">
    <remove name="WebDAVModule" />
  </modules>
</system.webServer>

Found here: https://www.ryadel.com/en/error-405-methods-not-allowed-asp-net-core-put-delete-requests/

answered Mar 27 '18 at 19:58

Manuel Alves

3,885
2
30
24

It worked but this made my website so slow in .net core 2.1 RC, I had to remove this instruction – Alexandre May 11 '18 at 21:50
1

@Alexandre This setting should really only be necessary for a service site. A website should respond to GET and POST by default, and really should need nothing else. If you are doing REST calls to your website, I would suggest off-loading these calls to a sub-application, and app pool that can be managed separately. – iGanja Apr 26 '19 at 15:39
I tried literally everything on my .NET 5 app and this fixed it. I'm doing a Blazor WASM app that is hosted on a Blazor web server. I can finally deploy everything to Azure and it works just as it does locally. Thank you. – Anzel Jul 27 '21 at 17:16

score 69 · Answer 2 · answered Jan 11 '18 at 09:02

69

After hours of research and trial and error, the fix seems to be pretty simple. Add a Web.config file to your .NET Core 2.0 application:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <!-- To customize the asp.net core module uncomment and edit the following section. 
         For more info see https://go.microsoft.com/fwlink/?linkid=838655 -->
    <system.webServer>
        <modules>
            <remove name="WebDAVModule" />
        </modules>
        <handlers>
            <remove name="aspNetCore" />
            <remove name="WebDAV" />
            <!-- I removed the following handlers too, but these
                 can probably be ignored for most installations -->
            <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
            <remove name="OPTIONSVerbHandler" />
            <remove name="TRACEVerbHandler" />

            <add name="aspNetCore" 
                 path="*" 
                 verb="*" 
                 modules="AspNetCoreModule" 
                 resourceType="Unspecified" />
        </handlers>
        <aspNetCore processPath="%LAUNCHER_PATH%" 
                    arguments="%LAUNCHER_ARGS%" 
                    stdoutLogEnabled="false"
                    stdoutLogFile=".\logs\stdout" />
    </system.webServer>
</configuration>

Hope this helps.

answered Jan 11 '18 at 09:02

Neilski

4,385
5
41
74

3

If I try to publish with a web.config file I just get an error near the end of the publish process. I read elsewhere that ASP.NET Core 2.0 doesn't support web.config files any more. Any ideas? – Dickie Watkins Aug 01 '18 at 07:24
How are you publishing - in Visual Studio, VSTS or something else? As notes below we are running in IIS 8.5 and .NET Core 2.0 without a problem. – Neilski Aug 01 '18 at 11:04
1

@DickieWatkins, in my case, with Asp.Net Core 2.1, and deploying from Visual Studio, a web.config was autogenerated on the server as part of the deployment process. If you just take that file, copy it to your project, add the `` as shown in this answer, then just set the build rule to "Copy Always," then in future deployments that same webconfig will be used, but appended to automatically. But, this is likely dependent on your deployment method and whether you're running IIS. – Kevin Fichter Aug 16 '18 at 19:11
Thanks a lot it took me just half a day to realize that my server has the problem and the iis is the problem and not the app itself – Nicu Mar 01 '19 at 13:46
I am using Kestrel, does this solution apply? – Franva Jul 03 '19 at 13:08
Found that only this was needed for me: – Rob10e Oct 25 '19 at 17:43
None of this works for me. I am using .NET Core 3.1, IIS express 10.0 and Visual studio 2019. I can't get http PUT to work. It's driving me crazy! Any ideas anyone? – Ant Waters Sep 08 '21 at 14:44

score 9 · Accepted Answer · answered Nov 22 '19 at 04:55

9

Whilst removing WebDAV may solve your issue, you may be wondering (like I was), what is WebDAV and what is it used for?

I found this page which helps explain it:

https://www.cloudwards.net/what-is-webdav/

answered Nov 22 '19 at 04:55

JTech

3,420
7
44
51

sasi reka · Answer 4 · 2021-02-01T09:15:52.130

8

In my case, I got the 405 error for .Net 5 Web API PUT and DELETE calls. I tried multiple solutions like removing WebDAV (Turn Windows features on or off -> IIS -> World Wide Web Services -> Common HTTP feature -> WebDAV Publishing) doesn't work, editing WebDAV entry in "Handler Mappings" messed up the application.

Solution

In IIS, select the application

Add rules to allow HTTP verbs in Request Filtering (But this alone doesn't work).
Go to "Modules", then select the "WebDAV Publishing" module and remove it.
Go to "Handler Mappings", then select the "WebDAV" and remove it.
in cmd run IISRESET

edited Feb 01 '21 at 09:15

answered Jan 27 '21 at 08:51

sasi reka

173
3
15

1

For me, with .NET 5, only steps 2 & 3 were necessaries to sort it out. Many thanks – dave Mar 23 '22 at 12:59
I literally don't know how to say thank you to you... You saved my job. I have been trying to solve this issue for the last 4 days and nights and found your answer just a few hours before the deadline. Thanks again. – Saurabh Kulkarni May 12 '23 at 07:44

Yush0 · Answer 5 · 2018-11-09T08:20:32.757

7

To prevent WebDav from getting enabled at all, remove the following entry from the ApplicationHost.config:

<add name="WebDAVModule" />

The entry is located in the modules section.

Exact location of the config:
C:\Windows\System32\inetsrv\config\applicationHost.config

This worked well for me in .Net Core 2.1

edited Nov 09 '18 at 08:20

answered May 31 '18 at 12:18

Yush0

1,547
18
22

2

Better to add the "remove" node instead; as shown in Manuel Alves' answer. If your app is a sub app, it can still pick up this setting from a parent web.config. The selected answer has a lot more code than is technically needed to simply allow all verbs. – iGanja Apr 26 '19 at 15:27
@iGanja: depending on the deployment process the web.config gets overwritten or you dont want to wrestle with it at all in .net core. It is also advisable to dont add unused features webserver wide for security. – Yush0 May 10 '19 at 10:24

score 7 · Answer 6 · answered Jun 16 '21 at 11:26

Add the following lines to your web.config file. That does it.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <location path="." inheritInChildApplications="false">
    <system.webServer>
        <modules>
            <remove name="WebDAVModule" />
        </modules>
      <handlers>
      
            <remove name="WebDAV" />
            <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
            <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,PUT,DELETE,DEBUG" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" responseBufferLimit="0" />
            
            <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="dotnet" arguments=".\Ftms.dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="inprocess" />
    </system.webServer>
  </location>
</configuration>

score 6 · Answer 7 · answered Dec 19 '18 at 14:54

6

Remove the WebDAV Publishing from IIS server. Its come under the Internet Infromation service -> Common Http Features

https://ignas.me/tech/405-method-not-allowed-iis/

answered Dec 19 '18 at 14:54

uthayathasan

61
1
1

Control Panel -> Uninstall Program -> Turn Windows features on or off -> IIS -> World Wide Web Services -> Common HTTP feature -> WebDAV Publishing. – JDNickell Aug 07 '19 at 17:05

score 4 · Answer 8 · answered Jun 30 '21 at 06:05

4

In my case, I resolved the issue after I add requireAccess="None" to aspNetCore handler

Like this :

<add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" requireAccess="None" />

answered Jun 30 '21 at 06:05

Stack Overflow

2,416
6
23
45

I added this to web.config and it worked. Thanks – omid-ahmadpour Apr 26 '22 at 06:34
is there a way how to add this to web config automatically during publishing? – David Bouška Aug 24 '22 at 11:28

score 1 · Answer 9 · answered Jun 25 '19 at 14:48

1

For me, I resolved the issue after I noticed I was trying to post to the client domain instead of the API. [facepalm]

answered Jun 25 '19 at 14:48

Eric

7,930
17
96
128

i searched for hours and seeing this comment saved my day. Thank you so much :) – nmb Oct 26 '22 at 16:50

score 0 · Answer 10 · answered Dec 16 '21 at 08:15

0

I didn't even have a mapping for aspnetcore under Handler Mappings in IIS. It made me open Visual Studio Installer and install Development time IIS support under .NET cross-platform development. Then, the aspnetcore handler mapping showed up in IIS.

answered Dec 16 '21 at 08:15

Mateusz Stępniak

73
1
2
8

so basically site is deployed to IIS so you can disable webdav there? – mikus Dec 27 '22 at 14:49

score 0 · Answer 11 · answered Dec 27 '22 at 15:05

If you're developing with recent ASP.NET Core version and using development server it's likely that it's not a WebDAV issue at all.

Make sure that your routes and HttpDelete/HttpPut attributes are set correctly. Otherwise you'll get the same or similar errors if the method is simply mismatched (e.g. route to a HttpGet one was chosen).

score 0 · Answer 12 · answered Jan 04 '23 at 02:41

0

After long research on the internet, I solved it as follows;

<configuration>
<system.webServer>
    <modules>
        <remove name="ModSecurity IIS (64bits)" />
        <remove name="ModSecurity IIS (32bits)" />
    </modules>
</system.webServer>

answered Jan 04 '23 at 02:41

user3186216

39
1
7

1

As it’s currently written, your answer is unclear. Please [edit] to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Jan 04 '23 at 03:07

score -1 · Answer 13 · answered Apr 15 '20 at 13:12

To prevent WebDav from getting enabled at all, remove or comment the following entry from the ApplicationHost.config:

<add name="WebDAVModule" />

The entry is located in the modules section.

Exact location of the config: C:\Windows\System32\inetsrv\config\applicationHost.config

This worked well for me in .Net Core 2.2

ASP.NET Core with IIS - HTTP Verb Not Allowed

13 Answers13

Linked