iss7 does not allow the OPTIONS preflight request for POST request - how to enable?

Question

We are running a WCF service hosted in Windows Azure and try perform POST requests from a website hosted elsewhere but this has proven to be really tricky. Apparently it seems to be REALLY difficult to allow the OPTIONS preflight request before the actual POST request in iis7 side.

Even though we have in our web.config <system.webserver> the definitions

  <httpProtocol>
      <customHeaders>
        <add name="Access-Control-Allow-Origin" value="*" />
        <add name="Access-Control-Allow-Headers" value="Origin,X-Requested-With,Content-Type,Accept" />
        <add name="Access-Control-Allow-Methods" value="POST,GET,OPTIONS"/>
      </customHeaders>
    </httpProtocol>

and for the security

<security>
  <requestFiltering>
    <verbs>
      <add verb="OPTIONS" allowed="true" />
    </verbs>
  </requestFiltering>
</security>

we keep getting HTTP 405 Method not Allowed response.

I've tried multiple tricks from different posts here in stackoverflow but I'm starting to be desperate as nothing seems to work... Site works in Chrome as it seems not to care about the preflight response but IE hangs on HTTP 405 response.

Does anyone know is possible in anyway to allow preflight OPTIONS request through web.config (and how) or do we need to start implementing our own handlers for the preflight request (and if so an example would be great :) )?

thanks, Matti

Answer 1

Check out this thread. I think WebDAV is installed on the Web Roles (cannot confirm it though). You have to RDP to the web role instance and check if this is the situation. If it is, you will need to create startup task to remove the WebDAV.

You can also check this and that articles on how to configure verbs in IIS via appcmd or vbscript (both can be executed via a startup task)

It appears that these things must be configured at Application Host config level, not allowed at web.config level.

Answer 2

IIS (at least version 7.*) definitely has a bug with preflight requests handling. I was using classic asp and adding this code to Web.config solved the issue

    <handlers>
        <remove name="OPTIONSVerbHandler" />
        <add name="OPTIONSVerbHandler" path="*" verb="OPTIONS" modules="IsapiModule" scriptProcessor="C:\Windows\System32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="None" />
    </handlers>