Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any security issues with allowing the DELETE verb on IIS 6? Does the DELETE verb do anything by default in IIS (ie: can you delete files etc.. with it if security is not set up properly?)

I am working on a REST application and I planned on using the http DELETE verb in certain requests. Our server admins have UrlScan installed and it is set to only allow GET and POST verbs. UrlScan can't selectively allow for certain paths, the rules are simply on or off, so it's enabled for the entire site. They reluctantly enabled DELETE for me, but I don't want to unknowingly open up a security hole.

share|improve this question
up vote 1 down vote accepted

If the IIS user (if it hasn't been changed from the default localsystem it would be an issue) has the rights to delete, then an attacker could use that access to delete files in the local system. WebDAV works using such a method.

There is a stackoverflow answer dealing with the workarounds of not using PUT and DELETE

share|improve this answer
I think that answers my question, but I have a hard time believing that it's possible by default. A solution would be to make sure the IIS user does not have rights to delete. – Lee Dec 16 '10 at 3:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.