HTTP 403.1 Access Denied on HttpHandler POST but not on GET

Question

User-263225972 posted

I developed a couple HttpHandlers on a Win2K server and am trying to get them running on a Windows 2003 Server. The handlers are contained in a single dll and I used the Web.Config file to direct any GET, POST, or HEAD requests to the proper handler.  When I issue a GET statement the Handler works just fine, however when I POST back to the same url I receive:

"HTTP Error 403.1 - Forbidden: Execute access is denied. "  and  "You have attempted to execute a CGI, ISAPI, or other executable program from a directory that does not allow programs to be executed. " 

I would think that if I did not have execute permissions on an extension that none of the methods would work, not even GET.  Am I wrong or does the GET method never need more than read permission even though you are executing a method in a dll?

I changed the WebConfig to direct any POST requests to the HEAD handler to rule out any failed execution logic in the post handler.  The head handler does nothing but return a static html string.  The results were the same. I then changed the Web.Config to point any GET requests to post handler and the head handler.  Both handlers executed when initiated as GETs

I have verified that the virtual directory permissions is set to allow both scripts and executables.  I have also configured the new "Web Server Extensions" to allow both ASP.NET and "All Unknown CGI programs and ISAPI Extensions" to be run   (I figure that I can tighten security once I figure out how to get it working)  I also made sure that both the GET and POST methods are supported in the extension mapping.

Any clues as to why POST isn't working?

 

Answer 1

User511787461 posted

Most probably, you have not specified POST in the list of verbs in the scriptmap in IIS/httpHandler in asp.net which maps this handler.

Answer 2

User-263225972 posted

I had configured the mapping of my file extension (.edm) to the aspnet_isapi.dll using the verbs GET, HEAD, and POST.  Apparently IIS only accepted the GET command because I had spaces after each of the commas.  I changed it to GET,HEAD,POST and everything started working.

Answer 3

User-1599151142 posted

Apparently IIS only accepted the GET command because I had spaces after each of the commas.  I changed it to GET,HEAD,POST and everything started working.

Thank you a lot. I had problems with POST requests from scripts (like "javascript:__doPostback("controlName",'')"), all of them was blocked with 403.1 HTTP error. All maping had have POST verb, but I haven't know, that spaces are forbidden. Just deleted spaces after each of the commas for files *.axd and now it works fine!