Unnecessary methods blocking

Owned by Daniel Gamallo
Jun 15, 2023
1 min read

To block the methods (verbs) do the following:

In IIS, This can be done by denying the 'OPTIONS' verb from the HTTP Verb Request Filtering rules in IIS.

  • Open IIS Manager.

  • Select the name of the machine to configure this globally

  • Double click on "Request Filtering".

  • Change to the HTTP Verbs tab.

 

 

  • From the Actions pane, select "Deny Verb".

  • Insert 'verbname' in the Verb, and press OK to save changes.

  • Repeat for all the elements in this list: ACL, ARBITRARY, BASELINE-CONTROL; BCOPY; BDELETE; BIND; BMOVE; BPROPFIND; BPROPPATCH; CHECKIN; CHECKOUT; CONNECT; COPY;DELETE; HEAD; INDEX; LABEL; LINK; LOCK; MERGE; MKACTIVITY; MKCALENDAR; MKCOL; MKREDIRECTREF; MKWORKSPACE; MOVE; NOTIFY; OPTIONS; ODERPATCH; PATCH; POLL; PROPFIND; PUT; REBIND; REPORT; RPC_IN_DATA; RPC_OUT_DATA; SEARCH; SUBSCRIBE; TRACE; TRACK; UNBIND; UNCHECKOUT; UNLINK; UNLOCK; UNSUBSCRIBE; UPDATE; UPDATEREDIRECTREF; VERSION-CONTROL; X-MS-ENUMATTS