Are there any security issues with allowing the DELETE verb on IIS 6? Does the DELETE verb do anything by default in IIS (ie: can you delete files etc.. with it if security is not set up properly?)
I am working on a REST application and I planned on using the http DELETE verb in certain requests. Our server admins have UrlScan installed and it is set to only allow GET and POST verbs. UrlScan can't selectively allow for certain paths, the rules are simply on or off, so it's enabled for the entire site. They reluctantly enabled DELETE for me, but I don't want to unknowingly open up a security hole.