I am working with a ASP.Net Web API 2 service and the firewall denies the DELETE method to go through (only POST and GET are allowed).

Is there a way that we can bypass this and invoke my DELETE method in the API?

  • @grochmal : This is a legitimate Information Security question. – user3496510 Jan 20 '17 at 1:01
  • @CodeRed - hmm... looking at the answers it can be. My mistake – grochmal Jan 20 '17 at 1:15

If it's blocked before it gets to the application, then no. If the application can't see it, the application can't do anything to allow it.

What you can do is to hack it. The most common way to implement verbs that are blocked, or are commonly blocked like DELETE and PUT is to add the X-Http-Method-Override header to your requests, and set the value for the verb you really want to use, but use POST as the HTTP verb for the request. Then you can create a DelegatingHandler that looks for that header after the request has entered the WebApi pipeline, and if it exists, you can change the request's actual HttpMethod from POST to DELETE at that point.


If I get your question clear, you can achieve what you are looking for using method overriding. All you need to do is , add following entry in the request header

X-HTTP-Method-Override : DELETE

Then do a POST request to your resource.

In the WEB API server end, you need to handle this method overriding using DelegatingHandler. Then you need to analyse what is the value in X-HTTP-Method-Override attribute and perform your actual operation accordingly.

Following is a sample code

public class MethodOverrideHandler : DelegatingHandler
    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
    CancellationToken cancellationToken)
        if (request.Method == HttpMethod.Post && request.Headers.Contains("X-HTTP-Method-Override"))
            var method = request.Headers.GetValues("X-HTTP-Method-Override").FirstOrDefault();
            bool isDelete = String.Equals(method, "DELETE", StringComparison.OrdinalIgnoreCase);
            if (isDelete)
                request.Method = new HttpMethod(method);
        return await base.SendAsync(request, cancellationToken);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.