How to block some HTTP methods to specific URL?

Question

For security reasons, i want to disable some http methods(e.x. OPTIONS, TRACE, HEAD) for URL through application level.

URL is "mywebsite.com/bundles/"

I tried this

<system.web>
<authorization>
    <deny verbs="OPTIONS" users="*" />
    <deny verbs="TRACE" users="*" />
    <deny verbs="HEAD" users="*" />
</authorization>

...

<httpHandlers>
    <add path="bundles" verb="OPTIONS" type="System.Web.DefaultHttpHandler" validate="true"/>
    <add path="bundles" verb="TRACE" type="System.Web.DefaultHttpHandler" validate="true"/>
    <add path="bundles" verb="HEAD" type="System.Web.DefaultHttpHandler" validate="true"/>
</httpHandlers>

And it blocks http methods for all app, but I want only for "/bundles" and it's files and subdirectories.

But "bundles" is not physical path in my app, but virtual

bundles.Add(new Bundle("~/bundles/Something").Include("~/Contents/Scripts/file.js"));
bundles.Add(new Bundle("~/bundles/Anything").Include("~/Areas/Import/Scripts/App/anotherfile.js"));

MisterSmith · Accepted Answer · 2018-07-02 21:38:56Z

1

You should be able to use a <location> element to restrict any enclosed directives to just the path you specify. E.g.

   <location path="bundles">
      <system.web>
         <authorization>
            <deny verbs="OPTIONS" users="*" />
         </authorization>
      </system.web>
   </location>

See https://msdn.microsoft.com/en-us/library/b6x6shw7(v=vs.100).aspx

answered Jul 2, 2018 at 21:38

MisterSmith

3,7041 gold badge12 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to block some HTTP methods to specific URL?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related