Getting a 401 error on MERGE operations in IIS 7.5 RRS feed

  • Question

  • I've got a simple WCF Data Service setup working great. Everything works fine on several development machines, but once we push up to our production server with Windows 2008 R2 running IIS 7.5, we begin getting 401 error (see below) for our MERGE updates. Everything else seems to be working fine. I'm guessing this is some sort of configuration issue that we need to address with IIS (maybe enabling the MERGE verb somewhere...?), but I've tried a few things and I can't seem to make a difference. We do have full control of the server, so I can make any necessary changes.

    Any ideas?


    HTTP/1.1 401 Unauthorized

    Cache-Control: private

    Content-Type: text/html

    Server: Microsoft-IIS/7.5

    X-AspNet-Version: 4.0.30319

    X-Powered-By: ASP.NET

    Date: Sat, 01 May 2010 13:43:39 GMT

    Content-Length: 58

    You do not have permission to view this directory or page.

    Saturday, May 1, 2010 3:38 PM


All replies

  • Hello,

    Please check if the IIS application's .svc extension allows MERGE as extra verb.


    Monica Frintu


    Tuesday, May 4, 2010 6:46 PM
  • Not sure how I can verify that. My configuration for the Handler Mappings is the default, and states "All verbs" as the option for "Request Restrictions" (Verbs tab). Shouldn't that be enough? Also, I'm only seeing this on HTTPS on the staging server, not on a local IIS with HTTP. Both have the default configuration.



    Thursday, June 24, 2010 12:29 PM
  • I'm still in the same boat - as far as I can tell, I can't configure any MERGE-Verb features in IIS 7.5 that make any difference, so I'm still getting the same problem.
    Thursday, July 22, 2010 9:28 PM
  • I am getting the same issue.

    I have tried listing the verb explicitly in the IIS7.5 management GUI.

    I have tried setting it up in the config file as follows:

    			<add name="svc-ISAPI-2.0" path="*.svc" verb="GET,SET,MERGE,POST" modules="IsapiModule" scriptProcessor="%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv2.0,bitness32" />
    <add name="svc-Integrated" path="*.svc" verb="GET,SET,MERGE,POST" type="System.ServiceModel.Activation.HttpHandler, System.ServiceModel, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089" resourceType="Unspecified" preCondition="integratedMode" />

    But it still does not work.

    The post marked as the answer is NOT the whole answer!

    What is the correct answer?


    Thursday, September 9, 2010 10:16 AM
  • I have the same error on the IIS 7.5 server but nothing on the development server (Cassini). Any news about it ?

    My svc files are configured to accept all verbs ... 

    Here is the IIS error : 12/22/2010, 17:11:09, 401, 0, MERGE, /test/Service1.svc/posts(223)


    Wednesday, December 22, 2010 4:18 PM
  • I have resolved this issue by adjusting rights on the physical location of my wcf data services. For testing purpose, I have set it as Full Control for Everyone, and it has been ok. 

    I wish that it will solve your matter.



    Thursday, May 12, 2011 6:20 AM
  • You can resolve it with more fine-grained permissions by allowing Authenticated Users write permissions on the .svc file as here...




    Still not ideal though.

    Monday, July 11, 2011 8:50 AM
  • I'm sure there is a way to add the Merge verb as an allowed verb, but I wasn't able to find it.  Allowing the user write permissions did also work, but it seems like it leaves a big vulnerability behind.

    What I did find was that you could set "UsePostTunneling" on the service context that allows the Update to be done through a the Post verb, with info in the header that tells the service that it's actually a merge action.


    • Proposed as answer by HutchCodesMVP Monday, April 30, 2012 1:50 PM
    Monday, April 30, 2012 1:50 PM