1

I am working with a ASP.Net Web API 2 service and the firewall denies the DELETE method to go through (only POST and GET are allowed).

Is there a way that we can bypass this and invoke my DELETE method in the API?

2
  • @grochmal : This is a legitimate Information Security question. Jan 20, 2017 at 1:01
  • @CodeRed - hmm... looking at the answers it can be. My mistake
    – grochmal
    Jan 20, 2017 at 1:15

2 Answers 2

1

If it's blocked before it gets to the application, then no. If the application can't see it, the application can't do anything to allow it.

What you can do is to hack it. The most common way to implement verbs that are blocked, or are commonly blocked like DELETE and PUT is to add the X-Http-Method-Override header to your requests, and set the value for the verb you really want to use, but use POST as the HTTP verb for the request. Then you can create a DelegatingHandler that looks for that header after the request has entered the WebApi pipeline, and if it exists, you can change the request's actual HttpMethod from POST to DELETE at that point.

0

If I get your question clear, you can achieve what you are looking for using method overriding. All you need to do is , add following entry in the request header

X-HTTP-Method-Override : DELETE

Then do a POST request to your resource.

In the WEB API server end, you need to handle this method overriding using DelegatingHandler. Then you need to analyse what is the value in X-HTTP-Method-Override attribute and perform your actual operation accordingly.

Following is a sample code

public class MethodOverrideHandler : DelegatingHandler
{
    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
    CancellationToken cancellationToken)
    {
        if (request.Method == HttpMethod.Post && request.Headers.Contains("X-HTTP-Method-Override"))
        {
            var method = request.Headers.GetValues("X-HTTP-Method-Override").FirstOrDefault();
            bool isDelete = String.Equals(method, "DELETE", StringComparison.OrdinalIgnoreCase);
            if (isDelete)
            {
                request.Method = new HttpMethod(method);
            }
        }
        return await base.SendAsync(request, cancellationToken);
    }
}
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .