Getting a 401 error on MERGE operations in IIS 7.5

Question

I've got a simple WCF Data Service setup working great. Everything works fine on several development machines, but once we push up to our production server with Windows 2008 R2 running IIS 7.5, we begin getting 401 error (see below) for our MERGE updates. Everything else seems to be working fine. I'm guessing this is some sort of configuration issue that we need to address with IIS (maybe enabling the MERGE verb somewhere...?), but I've tried a few things and I can't seem to make a difference. We do have full control of the server, so I can make any necessary changes.

Any ideas?

 

HTTP/1.1 401 Unauthorized

Cache-Control: private

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 May 2010 13:43:39 GMT

Content-Length: 58

You do not have permission to view this directory or page.

---

Chris

Answer 1

Hello,

Please check if the IIS application's .svc extension allows MERGE as extra verb.

Thanks,

Monica Frintu

 

Answer 2

Not sure how I can verify that. My configuration for the Handler Mappings is the default, and states "All verbs" as the option for "Request Restrictions" (Verbs tab). Shouldn't that be enough? Also, I'm only seeing this on HTTPS on the staging server, not on a local IIS with HTTP. Both have the default configuration.

 

 

Answer 3

I'm still in the same boat - as far as I can tell, I can't configure any MERGE-Verb features in IIS 7.5 that make any difference, so I'm still getting the same problem.

---

Chris

Answer 4

I am getting the same issue.

I have tried listing the verb explicitly in the IIS7.5 management GUI.

I have tried setting it up in the config file as follows:

			<add name="svc-ISAPI-2.0" path="*.svc" verb="GET,SET,MERGE,POST" modules="IsapiModule" scriptProcessor="%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv2.0,bitness32" />
			<add name="svc-Integrated" path="*.svc" verb="GET,SET,MERGE,POST" type="System.ServiceModel.Activation.HttpHandler, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" resourceType="Unspecified" preCondition="integratedMode" />

But it still does not work.

The post marked as the answer is NOT the whole answer!

What is the correct answer?

Matt

Answer 5

I have the same error on the IIS 7.5 server but nothing on the development server (Cassini). Any news about it ?

My svc files are configured to accept all verbs ... 

Here is the IIS error : 12/22/2010, 17:11:09, 401, 0, MERGE, /test/Service1.svc/posts(223)

 

Answer 6

I have resolved this issue by adjusting rights on the physical location of my wcf data services. For testing purpose, I have set it as Full Control for Everyone, and it has been ok. 

I wish that it will solve your matter.

 

Cheers.

---

Psyllos

Answer 7

You can resolve it with more fine-grained permissions by allowing Authenticated Users write permissions on the .svc file as here...

 

http://stackoverflow.com/questions/3458954/wcf-data-service-savechanges-problem

 

Still not ideal though.

Answer 8

I'm sure there is a way to add the Merge verb as an allowed verb, but I wasn't able to find it.  Allowing the user write permissions did also work, but it seems like it leaves a big vulnerability behind.

What I did find was that you could set "UsePostTunneling" on the service context that allows the Update to be done through a the Post verb, with info in the header that tells the service that it's actually a merge action.

http://jeremyhutchinson.wordpress.com/2012/04/30/401-unauthorized-error-on-merge/