Apparently DELETE and... most of the HTTP verbs are disabled by default in IIS (ASP/ MVC/ Microsoft server software)

Am I wrong in saying that's fucking bullshit?!

Why make an HTTP serving environment with a massive array of tools to help you do everything you need in the web environment... And then DISABLE some of the web protocol??? What???

Not even the obscure verbs. DELETE. Is microsoft the type of bitch to delete using a GET request?? I bet the send passwords as get parameters.

  • 16
    The core problem is that you tried to use IIS.
  • 8
    200 OK
    {"error": true, "msg": "Couldn't request resource"}
  • 5
    IIS originally comes from an era of "those verbs don't really exist because they're never used - we do everything with SOAP via POST."

    Pre-rest that was very much the state of things, and the issue is that once you've made that decision, it becomes very hard to justify reversing it for security reasons (what if someone is relying on them being blocked, upgrades and finds they aren't anymore?)

    But yeah, it's sucky. Don't use IIS.
  • 2
    IIS is bullshit. Use kestrel.
  • 2
    Microflakes. At the same time their frameworks do support bodies in GET messages, which while not terrible, is not guaranteed by the spec. This immediately becomes an issue when it encounters swagger metadata which precludes it's presence.
  • 0
    If they told me to use iis i would hand them my letter of resignation.
  • 0
    @SortOfTested But that's Microsoft's business model:
    Ignoring some parts of a standard and trying to make a new standard by abusing their market strength, so that enough people and software at some point depend on the MS version of the standard and are using MS software because it works only with MS.
  • 0
    I use IIS all the time. Never had a problem with disabled HTTP methods. Are you using an old version ?
Add Comment