How to enable PUT and DELETE Http Verbs on your IIS Website by removing WebDAV feature on Windows Server and Desktop machines.
Tags: iis, webdav, http, aspnetcore
Published: 2022-06-13 18:29:44

_For dear lazy reader: scroll down to **[Summary](#summary)** then up to **[Solutions](#solutions)**, you are good to go!_.



## Background

So, I deployed a web app (ASP.NET Core Web API) on [IIS](https://en.wikipedia.org/wiki/Internet_Information_Services) through Azure DevOps Pipeline. While I could make requests to endpoints using `POST` and `GET`, I couldn't make HTTP calls to endpoints designated with `PUT` and `DELETE` Verbs.

Like every other Software Developer, I went online to source for answers. [Stackoverflow](https://stackoverflow.com/questions/48188895/asp-net-core-with-iis-http-verb-not-allowed) is always my first choice, there I learnt that I need to add some configurations in the web.config file on the server to remove "WebDAVModule" (Bear with me, I will explain).

This I did by [RDP](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol)ing (going into a remote computer from your computer using a GUI as opposed to the CLI) to the server, editing the _web.config_ file (an XML file for configuration) and everything was fine. 

But because I need to run the release pipeline every other time on Azure DevOps to make new deployments, the _web.config_ file gets replaced and I'm back to where I was initially, needing to do the manual "WebDAVModule" thingy again. RDPing to the server and editing the _web.config_ again and again. Infuriating!. 

Trying to rid myself of this frustration, a couple of questions popped, one question led to another question in the following order;

* How to edit the _web.Config_ file on Azure DevOps Pipeline on a new release?_(coming soon)_.

* How to permanently disable the _WebDAV Module_?

* What is the relationship WebDAV and HTTP Verbs?


## What is WebDAV?

Story time… Don’t worry it’s a short one, really. Nah…

In 1989 while working at [CERN](https://en.wikipedia.org/wiki/CERN) in Switzerland, amongst other things, Tim Berners-Lee invented the World Wide Web and the web browser called _WorldWideWeb_.

Unlike what we can do with web browsers today, back then you could not only view web pages, you could also edit them right there on your browser like you would do over FTP, making your web server act like a file server. 

As time went by this changed and now you can only view web pages in your browser.

A group of guys led by Jim Whitehead decided to remove this limitation and restore the old functionalities so that you could edit contents on the web server from your web browser. This birthed WebDAV. 

**End of story**. 

WebDAV gives the server a new set of abilities which include file manipulation and version tracking. 

If you don't fret at the sight of technical jargons, check out the full story [here](https://www.cloudwards.net/what-is-webdav/), I am sure this link also has links to more technical jargons. Goodluck!

So, let’s define WebDAV…

_WebDAV stands for Web Distributed Authoring and Versioning, it adds more methods and headers to the set of standard HTTP headers and methods to let you create, move and edit files, as well as delete or copy files and folders_.

_Beyond these actions, it also has features that allow versioning, that is, keeping track of changes made to files and folders on the web server simultaneously by multiple users communicating with the web server_. 

_Consequently, this facilitates collaboration just like with GitHub. WebDAV is a powerful extension to the HTTP protocol_. More info [here](https://www.cloudwards.net/what-is-webdav/).


## Relationship between WebDAV and HTTP Verbs?

When you make HTTP requests with your web browsers (or Postman) to  web servers that have WebDAV modules installed, you are limited to `GET` and `POST` `HTTP` Verbs. 

That is, you can read and create contents on a web server through your browser, but you can’t `PUT` or `DELETE`. 

This happens because PUT and DELETE are part of WebDAV verbs  and the _WebDAV module_ claims incoming requests with these verbs and returns “405 Method not allowed” response. 

_The solution would be to remove the WebDAV module from your IIS site or web server altogether_.

## Assumptions

* You have access to your app web server.
* Your app is deployed on Windows server.
* Your app is on IIS.


## Solutions

While WebDAV is supported on various servers, including the Apache HTTP server, the SabreDAV server, Nginx server, ownCloud and Nextcloud, this article focuses on Microsoft’s Internet Information Services (IIS). 

To be able to make `PUT` and `DELETE` requests to your web app, you need to remove _WebDAV Module_ on IIS website or remove the WebDAV feature from your app server. 

The following are 3 ways you can do this;

#### 1. Manually edit _web.config_ to disable WebDAV (The Quick one but not the best):

You just need  to set your _Web.Config_ file as follows to remove the WebDAV module from the application:
```
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <location path="." inheritInChildApplications="false">
    <system.webServer>
	<modules> 
                        <remove name="WebDAVModule" /> 
     	 </modules> 
      <handlers>
	       <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="dotnet" arguments=".\[app name].dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="inprocess">
                <environmentVariables>
                    <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Staging" />
                </environmentVariables>
            </aspNetCore>
    </system.webServer>
  </location>
</configuration>
```

**N.B.**: _This solution only affects the current application (website).To apply this to all the applications on IIS, check solution 3_.


#### 2.  Disable WebDAVModule in the Internet Information Services Manager:

a. Open the _IIS Manager_ and navigate to the website. 
b. Double-click the _Handler Mappings_ item. 

![IIS window showing _Handler Mappings_.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6zue9gll5p6ur4q6nw4y.png)

 c. Right click WebDAV and select Remove.

![IIS window showing WebDAV under _Handler Mappings_.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8yb6hssqi4ardg04ymm9.png)
 
 d. Navigate back to your website. 
 e. Double-click the _Modules_ item. 

![IIS window showing showing WebDAV "Modules" as selected item.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/744xizt16dmum84a2axw.png)

 f. Right click _WebDAVModule_ and select Remove.

![IIS window showing WebDAV under _Modules_ item.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lg1px1lcjxt24p2t22uv.jpg)

**N.B.**: _This solution only affects the current application  (website).To apply this to all the applications on IIS, check solution 3_.

#### 3. Remove the WebDAV Publishing feature on Windows

##### On a Windows Server:

a. Open the _Server Manager_ and select "Manage",

b. Select "Remove Roles and Features", 

![_Windows Server Manager_ showing _Manage_ option selected](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vp1wshntkka5hyzi2oi2.png)


 c. jump to the "Server Roles" section and uncheck the following option: Web Server (IIS) > Web Server > Common HTTP Features > WebDAV Publishing.

![_Windows Server Manager_ showing _WebDAV Publishing_ unchecked](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/un2hvp3kthtmcp4agp2f.png)


 d. Select "Next" until you can select "Remove" on the Confirmation section.

![_Windows Server Manager_ showing removal of _WebDAV Publishing_](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kmpb24vv1p4sldmoui9v.png)


 e. You may need to restart the server for the change to take effect.

##### On Windows Desktop:
a. Open a Windows Explorer window and navigate to Control Panel\All Control Panel Items\Programs and Features.

b. Select the Turn Windows features on or off option. 

![Screenshot showing _Control Panel_ and _"Turn Windows features on or off"_](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3fkpms7j6355y9apriln.png)


 c. Uncheck the following option: Internet Information Services > World Wide Web Services > Common HTTP Features > WebDAV Publishing. 

![Screenshot showing _Control Panel_ and showing _WebDAV Publishing_ unchecked](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/862j04lyfpcdlejhqi2f.png)


 d. Click OK. You may need to restart the server for the change to take effect.


## Summary

WebDAV is a set of extensions to the HTTP protocol which allows users to collaboratively edit and manage files on remote web servers. 

WebDAV module is a feature on Windows Server that allows the web server to have WebDAV functionalities.

> If WebDAV is installed on the server, it becomes the first handler of HTTP requests, and intercepts all `PUT` and `DELETE` requests, so they don’t even reach your Web application.

The simplest **[Solution](#solutions)** is to uninstall WebDAV on your server using the _Server Manager_ application.





**End of article**.