Are there any security issues with allowing the DELETE verb on IIS 6? Does the DELETE verb do anything by default in IIS (ie: can you delete files etc.. with it if security is not set up properly?)

I am working on a REST application and I planned on using the http DELETE verb in certain requests. Our server admins have UrlScan installed and it is set to only allow GET and POST verbs. UrlScan can't selectively allow for certain paths, the rules are simply on or off, so it's enabled for the entire site. They reluctantly enabled DELETE for me, but I don't want to unknowingly open up a security hole.


If the IIS user (if it hasn't been changed from the default localsystem it would be an issue) has the rights to delete, then an attacker could use that access to delete files in the local system. WebDAV works using such a method.

There is a stackoverflow answer dealing with the workarounds of not using PUT and DELETE


| improve this answer | |
  • I think that answers my question, but I have a hard time believing that it's possible by default. A solution would be to make sure the IIS user does not have rights to delete. – Lee Dec 16 '10 at 3:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.