Fix for HTTPVerbTampering in MVC3

Question

We have an application which is developed using MVC3 and .Net framework 4.0. To prevent HTTP Verb Tampering, we have included below code in application's web.config file. In local machine given fix was working as expected and returns 401 unauthorized code.

   <authorization>
      <allow verbs="GET" users="*" />
      <allow verbs="POST" users="*" />
      <deny verbs="*" />
    </authorization>

When we deployed the same code, test result returns 202 OK. So the fix is not working. Is there any way around that we can fix this issue?

Did you verify that the site you test against actually uses this configuration? — CodeCaster, Dec 08 '17 at 12:09
Where did you deploy that? Was it on Azure? Windows Machine with IIS? — rodrigogq, Dec 08 '17 at 13:44
@CodeCaster - I have configured in Application's Web.config file not on server side. — Tech Learner, Dec 11 '17 at 05:18
@Ask_SO I guess the next important question is: IIS version running on your machine vs IIS version running on your server... — rodrigogq, Dec 11 '17 at 10:17

rodrigogq · Answer 1 · 2017-12-12T12:01:32.940

Are you are working with the "Play" button on Visual Studio? Is this using a IIS Express or are you really "deploying" that to an IIS WebAPP on your local machine?

I usually do not use the "Play" button when I am developing for IIS, specially when I am developing for a specif IIS Server. When that happens, I try to have the same IIS Server configuration on my machine and create a WebApp pointing to my Dev folder to test it.

If you are having trouble to config your web.config, I would use the IIS visual tools, check the modifications made on the web.config and commit that.

Please note that there are some differences in the configuration in the ASP.NET side and on the IIS side:

Please check this website: https://learn.microsoft.com/en-us/iis/manage/configuring-security/understanding-iis-url-authorization

And refer to these notes:

Differences Between ASP.NET URL Authorization and IIS URL Authorization

There are small but important differences between ASP.NET UrlAuthorization and IIS URL Authorization.

ASP.NET Url Authorization is installed when you install ASP.NET on top of IIS.

This refers to IIS 7.0 Even though several configurations are compatible between one IIS to another, some specific changes might apply.

Fix for HTTPVerbTampering in MVC3

1 Answers1