Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I restrict HTTP methods to those required by the MOSS07 application(s) using IIS6?

Update

This is what was written in the document

IIS6 should be used to restrict HTTP methods to those required by the MOSS07 application(s).

I also searched some books and saw something curious in O'Reilly's Sharepoint 2007 by James Pyles and others.

There is no real suppported way to use HTTP POST and HTTP GET because of the web.config settings and the static definition of the WSDL. In the web.config

<protocols> 
 <remove name="HttpGet">
 <remove name="HttpPost">
 <remove name="HttpPostLocalHost">
 <add name="Documentation">
</protocols>

If we do this in the Web.Config file, would it solve the problem?

share|improve this question
    
Are you referring to GET, POST, PUT methods, or parameters of the HTTP requests? More info would help –  Andy Oct 30 '09 at 13:04
    
I actually do not know. This is to be done from Security purview. Some of the methods which are used by MOSS2007 have to blocked.. I even dont know how to block / unblock HTTP Methods. A guidence to that would be helpful. –  hemalshah Oct 30 '09 at 14:16
    
Please provide more information. If you're following a document, paste the specific instructions here, then it's easier for us to offer guidance. –  Scott Forsyth - MVP Oct 30 '09 at 17:41
add comment

2 Answers

If you want to block certain HTTP methods (verbs), you can do that in IIS 6.0 with URLScan.

I think the web.config entries you posted are for a web service that is intended to only be accessible over the SOAP method, but I don't know if that's what you actually want do to.

You can also restrict the methods allowed for each application extension in IIS Admin. These settings are behind the Configuration button on the Home Directory tab.

share|improve this answer
add comment

One way of doing this is to put your web-server behind a reverse-proxy and restrict the HTTP methods in the reverse-proxy. It is possible to compile pound and run it on Windows/Cygwin and pound can already do this automatically. However, it should not be too difficult to write a simple socket programme to do this in your favourite language..

share|improve this answer
    
thanks for the suggestion Sybreon. I am looking to do this more or less within IIS as its been mentioned in one of the security related document. –  hemalshah Nov 4 '09 at 11:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.