Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there any security issues with allowing the DELETE verb on IIS 6? Does the DELETE verb do anything by default in IIS (ie: can you delete files etc.. with it if security is not set up properly?)

I am working on a REST application and I planned on using the http DELETE verb in certain requests. Our server admins have UrlScan installed and it is set to only allow GET and POST verbs. UrlScan can't selectively allow for certain paths, the rules are simply on or off, so it's enabled for the entire site. They reluctantly enabled DELETE for me, but I don't want to unknowingly open up a security hole.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

If the IIS user (if it hasn't been changed from the default localsystem it would be an issue) has the rights to delete, then an attacker could use that access to delete files in the local system. WebDAV works using such a method.

There is a stackoverflow answer dealing with the workarounds of not using PUT and DELETE

http://stackoverflow.com/questions/23963/restful-web-services-and-http-verbs

share|improve this answer
    
I think that answers my question, but I have a hard time believing that it's possible by default. A solution would be to make sure the IIS user does not have rights to delete. –  Lee Dec 16 '10 at 3:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.