How to enable PUT and DELETE Http Verbs on your IIS Website by removing WebDAV feature on Windows Server and Desktop machines.

Samuel Babatunde — Mon, 13 Jun 2022 18:29:44 +0000

For dear lazy reader: scroll down to Summary then up to Solutions, you are good to go!.

Background

So, I deployed a web app (ASP.NET Core Web API) on IIS through Azure DevOps Pipeline. While I could make requests to endpoints using POST and GET, I couldn't make HTTP calls to endpoints designated with PUT and DELETE Verbs.

Like every other Software Developer, I went online to source for answers. Stackoverflow is always my first choice, there I learnt that I need to add some configurations in the web.config file on the server to remove "WebDAVModule" (Bear with me, I will explain).

This I did by RDPing (going into a remote computer from your computer using a GUI as opposed to the CLI) to the server, editing the web.config file (an XML file for configuration) and everything was fine.

But because I need to run the release pipeline every other time on Azure DevOps to make new deployments, the web.config file gets replaced and I'm back to where I was initially, needing to do the manual "WebDAVModule" thingy again. RDPing to the server and editing the web.config again and again. Infuriating!.

Trying to rid myself of this frustration, a couple of questions popped, one question led to another question in the following order;

How to edit the web.Config file on Azure DevOps Pipeline on a new release?(coming soon).
How to permanently disable the WebDAV Module?
What is the relationship WebDAV and HTTP Verbs?

What is WebDAV?

Story time… Don’t worry it’s a short one, really. Nah…

In 1989 while working at CERN in Switzerland, amongst other things, Tim Berners-Lee invented the World Wide Web and the web browser called WorldWideWeb.

Unlike what we can do with web browsers today, back then you could not only view web pages, you could also edit them right there on your browser like you would do over FTP, making your web server act like a file server.

As time went by this changed and now you can only view web pages in your browser.

A group of guys led by Jim Whitehead decided to remove this limitation and restore the old functionalities so that you could edit contents on the web server from your web browser. This birthed WebDAV.

End of story.

WebDAV gives the server a new set of abilities which include file manipulation and version tracking.

If you don't fret at the sight of technical jargons, check out the full story here, I am sure this link also has links to more technical jargons. Goodluck!

So, let’s define WebDAV…

WebDAV stands for Web Distributed Authoring and Versioning, it adds more methods and headers to the set of standard HTTP headers and methods to let you create, move and edit files, as well as delete or copy files and folders.

Beyond these actions, it also has features that allow versioning, that is, keeping track of changes made to files and folders on the web server simultaneously by multiple users communicating with the web server.

Consequently, this facilitates collaboration just like with GitHub. WebDAV is a powerful extension to the HTTP protocol. More info here.

Relationship between WebDAV and HTTP Verbs?

When you make HTTP requests with your web browsers (or Postman) to web servers that have WebDAV modules installed, you are limited to GET and POST HTTP Verbs.

That is, you can read and create contents on a web server through your browser, but you can’t PUT or DELETE.

This happens because PUT and DELETE are part of WebDAV verbs and the WebDAV module claims incoming requests with these verbs and returns “405 Method not allowed” response.

The solution would be to remove the WebDAV module from your IIS site or web server altogether.

Assumptions

You have access to your app web server.
Your app is deployed on Windows server.
Your app is on IIS.

Solutions

While WebDAV is supported on various servers, including the Apache HTTP server, the SabreDAV server, Nginx server, ownCloud and Nextcloud, this article focuses on Microsoft’s Internet Information Services (IIS).

To be able to make PUT and DELETE requests to your web app, you need to remove WebDAV Module on IIS website or remove the WebDAV feature from your app server.

The following are 3 ways you can do this;

1. Manually edit web.config to disable WebDAV (The Quick one but not the best):

You just need to set your Web.Config file as follows to remove the WebDAV module from the application:



<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <location path="." inheritInChildApplications="false">
    <system.webServer>
    <modules> 
                        <remove name="WebDAVModule" /> 
         </modules> 
      <handlers>
           <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="dotnet" arguments=".\[app name].dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="inprocess">
                <environmentVariables>
                    <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Staging" />
                </environmentVariables>
            </aspNetCore>
    </system.webServer>
  </location>
</configuration>

N.B.: This solution only affects the current application (website).To apply this to all the applications on IIS, check solution 3.

2. Disable WebDAVModule in the Internet Information Services Manager:

a. Open the IIS Manager and navigate to the website.
b. Double-click the Handler Mappings item.

c. Right click WebDAV and select Remove.

d. Navigate back to your website.
e. Double-click the Modules item.

f. Right click WebDAVModule and select Remove.

N.B.: This solution only affects the current application (website).To apply this to all the applications on IIS, check solution 3.

3. Remove the WebDAV Publishing feature on Windows

On a Windows Server:

a. Open the Server Manager and select "Manage",

b. Select "Remove Roles and Features",

c. jump to the "Server Roles" section and uncheck the following option: Web Server (IIS) > Web Server > Common HTTP Features > WebDAV Publishing.

d. Select "Next" until you can select "Remove" on the Confirmation section.

e. You may need to restart the server for the change to take effect.

On Windows Desktop:

a. Open a Windows Explorer window and navigate to Control Panel\All Control Panel Items\Programs and Features.

b. Select the Turn Windows features on or off option.

c. Uncheck the following option: Internet Information Services > World Wide Web Services > Common HTTP Features > WebDAV Publishing.

d. Click OK. You may need to restart the server for the change to take effect.

Summary

WebDAV is a set of extensions to the HTTP protocol which allows users to collaboratively edit and manage files on remote web servers.

WebDAV module is a feature on Windows Server that allows the web server to have WebDAV functionalities.

If WebDAV is installed on the server, it becomes the first handler of HTTP requests, and intercepts all PUT and DELETE requests, so they don’t even reach your Web application.

The simplest Solution is to uninstall WebDAV on your server using the Server Manager application.

End of article.

DEV Community: Samuel Babatunde