.NET web api HttpPatch returning 403 forbidden

Question

I have a simple resource that provides a list of translations. The get end point takes a language and returns a dictionary of translations. Any updates are going to be on just one translation, so I figured that would be appropriate to do as a patch.

In my api controller, I can make a put work just fine, but any call I make to my patch end point is giving me a 403 forbidden error and I don't understand why.

 [HttpGet]
    // GET api/<controller>
    public Dictionary<string,string> Get(String id)
    {
        return TranslationSvc.GetTranslatedStrings(id);
    }



    [HttpPatch]
    public TranslationEntry Patch(TranslationEntry data)
    {//403 prevents this end point from ever executing
        if (TranslationSvc.UpdateTranslation(data.Lang, "", data.Translation.Key, data.Translation.Value))
        {
            return data;
        }
        else
        {
            //return a 500 error;
            throw new HttpResponseException(HttpStatusCode.InternalServerError);
        }
    }

    [HttpPut]
    public TranslationEntry Put(TranslationEntry data)
    {//works, but technically a put should be the full resource which is the full collection
        if (TranslationSvc.UpdateTranslation(data.Lang, "", data.Translation.Key, data.Translation.Value))
        {
            return data;
        }
        else
        {
            //return a 500 error;
            throw new HttpResponseException(HttpStatusCode.InternalServerError);
        }
    }

Answer 1

I found the problem. I had forgotten that I was running against a local proxy that simulated our single sign on behaviors. That local proxy was configured to deny anything but GET and post actions basically. Sorry for the false alarm question :)