#webconfig

Enable PUT and DELETE Http verbs for WebAPI with Cors on IIS 8.5

WebAPI in .Net by default allows only the GET, POST, OPTIONS and HEAD verbs. To allow PUT and DELETE, you need to remove the WebDAV handler and module from the request pipeline by making the following changes to the Web.Config.

The WebDAV element contains the settings that configure Web Distributed Authoring and Versioning (WebDAV) for Internet Information Services (IIS) 7 or above. WebDAV is…

Here’s a single IIS 7 Rewrite rule to force wildcard/filtered domains to WWW and retain the original protocol.  We’ve tested and have moved this into production and it seems to be working very well.  Previously our ColdFusion web application would do this, but moving this function to the web server is better/faster.

Can anyone identify any problems/shortcomings with this approach?

Updated: The following article describes the new released CORS Module for Web Api which allows much finer control over CORS requests: http://weblogs.asp.net/scottgu/archive/2013/04/19/asp-net-web-api-cors-support-and-attribute-based-routing-improvements.aspx

--- the old way --

Just paste the following (modified if required) in your C# Web Api web.config file:

<system.webServer> <httpProtocol> <customHeaders> <add name="Access-Control-Allow-Origin" value="*" /> <add name="Access-Control-Allow-Headers" value="Authorization" /> <add name="Access-Control-Allow-Methods" value="GET, POST, OPTIONS" /> </customHeaders> </httpProtocol> <system.webServer>