Troubleshooting HTTP 405 Errors after Publishing Web API 2 Applications
This tutorial describes how to troubleshoot HTTP 405 errors after publishing a Web API application to a production web server.
Software versions used in the tutorial
- Internet Information Services (IIS) (version 7 or later)
- Web API (version 1 or 2)
Web API applications typically use several common HTTP verbs: GET, POST, PUT, DELETE, and sometimes PATCH. That being said, developers may run into situations where those verbs are implemented by another IIS module on their production server, which leads to a situation where a Web API controller that works correctly in Visual Studio or on a development server will return an HTTP 405 error when it is deployed to a production server. Fortunately this problem is easily resolved, but the resolution warrants an explanation of why the problem is occurring.
What Causes HTTP 405 Errors
The first step toward learning how to trouble HTTP 405 errors is to understand what an HTTP 405 error actually means. The primary governing document for HTTP is RFC 2616, which defines the HTTP 405 status code as Method Not Allowed, and further describes this status code as a situation where “the method specified in the Request-Line is not allowed for the resource identified by the Request-URI.” In other words, the HTTP verb is not allowed for the specific URL that an HTTP client has requested.
As a brief review, here are several of the most-used HTTP methods as defined in RFC 2616, RFC 4918, and RFC 5789:
| HTTP Method | Description |
|---|---|
| GET | This method is used to retrieve data from a URI, and it probably the most-used HTTP method. |
| HEAD | This method is much like the GET method, except that it doesn’t actually retrieve the data from the request URI - it simply retrieves the HTTP status. |
| POST | This method is typically used to send new data to the URI; POST is often used to submit form data. |
| PUT | This method is typically used to raw data to the URI; PUT is often used to submit JSON or XML data to Web API applications. |
| DELETE | This method is used to remove data from a URI. |
| OPTIONS | This method is typically used to retrieve the list of HTTP methods that are supported for a URI. |
| COPY MOVE | These two methods are used with WebDAV, and their purpose is self-explanatory. |
| MKCOL | This method is used with WebDAV, and it is used to create a collection (e.g. a directory) at the specified URI. |
| PROPFIND PROPPATCH | These two methods are used with WebDAV, and they are used to query or set properties for a URI. |
| LOCK UNLOCK | These two methods are used with WebDAV, and they are used to lock/unlock the resource identified by the request URI when authoring. |
| PATCH | This method is used to modify an existing HTTP resource. |
When one of these HTTP methods is configured for use on the server, the server will respond with the HTTP status and other data that is appropriate for the request. (For example, a GET method might receive an HTTP 200 OK response, and a PUT method might receive an HTTP 201 Created response.)
If the HTTP method is not configured for use on the server, the server will respond with an HTTP 501 Not Implemented error.
However, when an HTTP method is configured for use on the server, but it has been disabled for a given URI, the server will respond with an HTTP 405 Method Not Allowed error.
Example HTTP 405 Error
The following example HTTP request and response illustrate a situation where an HTTP client is attempting to PUT value to a Web API application on a web server, and the server returns an HTTP error which states that the PUT method is not allowed:
HTTP Request:
[!code-consoleMain]
1: PUT /api/values/1 HTTP/1.1
2: Content-type: application/json
3: Host: localhost
4: Accept: */*
5: Content-Length: 12
6:
7: "Some Value"
HTTP Response:
[!code-consoleMain]
1: HTTP/1.1 405 Method Not Allowed
2: Cache-Control: no-cache
3: Pragma: no-cache
4: Content-Type: application/json; charset=utf-8
5: Expires: -1
6: Server: Microsoft-IIS/8.0
7: X-Powered-By: ASP.NET
8: Date: Wed, 15 May 2013 02:38:57 GMT
9: Content-Length: 72
10:
11: {"Message":"The requested resource does not support http method 'PUT'."}
In this example, the HTTP client sent a valid JSON request to the URL for a Web API application on a web server, but the server returned an HTTP 405 error message which indicates that the PUT method was not allowed for the URL. In contrast, if the request URI did not match a route for the Web API application, the server would return an HTTP 404 Not Found error.
Resolving HTTP 405 Errors
There are several reasons why a specific HTTP verb may not be allowed, but there is one primary scenario that is the leading cause of this error in IIS: multiple handlers are defined for the same verb/method, and one of the handlers is blocking the expected handler from processing the request. By way of explanation, IIS processes handlers from first to last based on the order handler entries in the applicationHost.config and web.config files, where the first matching combination of path, verb, resource, etc., will be used to handle the request.
The following example is an excerpt from an applicationHost.config file for an IIS server that was returning an HTTP 405 error when using the PUT method to submit data to a Web API application. In this excerpt, several HTTP handlers are defined, and each handler has a different set of HTTP methods for which it is configured - the last entry in the list is the static content handler, which is the default handler that is used after the other handlers have had a chance to examine the request:
[!code-xmlMain]
1: <handlers accessPolicy="Read, Script">
2: <add name="WebDAV"
3: path="*"
4: verb="PROPFIND,PROPPATCH,MKCOL,PUT,COPY,DELETE,MOVE,LOCK,UNLOCK"
5: modules="WebDAVModule"
6: resourceType="Unspecified"
7: requireAccess="None" />
8: <add name="ISAPI-dll"
9: path="*.dll"
10: verb="*"
11: modules="IsapiModule"
12: resourceType="File"
13: requireAccess="Execute"
14: allowPathInfo="true" />
15: <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit"
16: path="*."
17: verb="GET,HEAD,POST,DEBUG"
18: modules="IsapiModule"
19: scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll"
20: preCondition="classicMode,runtimeVersionv4.0,bitness64"
21: responseBufferLimit="0" />
22:
23: <!-- Additional handlers will be defined here. -->
24:
25: <add name="StaticFile"
26: path="*"
27: verb="*"
28: modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule"
29: resourceType="Either"
30: requireAccess="Read" />
31: </handlers>
In the above example, the WebDAV handler and the Extension-less URL Handler for ASP.NET (which is used for Web API) are clearly defined for separate lists of HTTP methods. Note that the ISAPI DLL handler is configured for all HTTP methods, although this configuration will not necessarily cause an error. However, configuration settings like this need to be considered when troubleshooting HTTP 405 errors.
In the above example, the ISAPI DLL handler was not the problem; in fact, the problem was not defined in the applicationHost.config file for the IIS server - the problem was caused by an entry that was made in the web.config file when the Web API application was created in Visual Studio. The following excerpt from the application’s web.config file shows the location of the problem:
[!code-xmlMain]
1: <handlers accessPolicy="Read, Script">
2: <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
3: <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit"
4: path="*."
5: verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS"
6: modules="IsapiModule"
7: scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll"
8: preCondition="classicMode,runtimeVersionv4.0,bitness64"
9: responseBufferLimit="0" />
10: </handlers>
In this excerpt, the Extension-less URL Handler for ASP.NET is redefined to include additional HTTP methods that will be used with the Web API application. However, since a similar set of HTTP methods is defined for the WebDAV handler, a conflict occurs. In this specific case, the WebDAV handler is defined and loaded by IIS, even though WebDAV is disabled for the website that includes the Web API application. During the processing of an HTTP PUT request, IIS calls the WebDAV module since it is defined for the PUT verb. When the WebDAV module is called, it checks its configuration and sees that it is disabled, so it will return an HTTP 405 Method Not Allowed error for any request that resembles a WebDAV request. To resolve this issue, you should remove WebDAV from the list of HTTP modules for the website where your Web API application is defined. The following example shows what that might look like:
[!code-xmlMain]
1: <handlers accessPolicy="Read, Script">
2: <remove name="WebDAV" />
3: <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
4: <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit"
5: path="*."
6: verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS"
7: modules="IsapiModule"
8: scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll"
9: preCondition="classicMode,runtimeVersionv4.0,bitness64"
10: responseBufferLimit="0" />
11: </handlers>
This scenario is often encountered after an application is published from a development environment to a production environment, and this occurs because the list of handlers/modules is different between your development and production environments. For example, if you are using Visual Studio 2012 or 2013 to develop a Web API application, IIS Express 8 is the default web server for testing. This development web server is a scaled-down version of the full IIS functionality that ships in a server product, and this development web server contains a few changes that were added for development scenarios. For example, the WebDAV module is often installed on a production web server that is running the full version of IIS, although it may not be in actual use. The development version of IIS, (IIS Express), installs the WebDAV module, but the entries for the WebDAV module are intentionally commented out, so the WebDAV module is never loaded on IIS Express unless you specifically alter your IIS Express configuration settings to add WebDAV functionality to your IIS Express installation. As a result, your web application may work correctly on your development computer, but you may encounter HTTP 405 errors when you publish your Web API application to your production web server.
Summary
HTTP 405 errors are caused when an HTTP method is not allowed by a web server for a requested URL. This condition is often seen when a particular handler has been defined for a specific verb, and that handler is overriding the handler that you expect to process the request.
If you encounter a situation where you receive an HTTP 501 error message, which means that the specific functionality has not been implemented on the server, this often means that there is no handler defined in your IIS settings which matches the HTTP request, which probably indicates that something was not installed correctly on your system, or something has modified your IIS settings so that there are no handlers defined that support the specific HTTP method. To resolve that issue, you would need to reinstall any application that is attempting to use an HTTP method for which it has no corresponding module or handler definitions.
)
|
|