How do I allow the GET request for only one method or webservice?

Question

As I've found here, I can change the webconfig to allow/disallow methods on webservices.

I need only one method to be a GET and for the others it should be a POST, is there a way to configure just one method (or maybe webservice if there is no other way) to accept GET requests? I am on IIS7.

Answer 1

Depends on the web server.

You can return errors on certain requests in Apache, for instance.

Use the Limit directive:

<Directory />
  Options All
  AllowOverride All
  <Limit POST PUT DELETE CONNECT PROPFIND PROPPATCH>
    # Require valid-user
    Deny from all
  </Limit>
</Directory>

Edit - Just found the documentation on this: http://httpd.apache.org/docs/2.0/mod/core.html#limit

Answer 2

You can do it by changing the handler mappings, either in IIS or through the httpHandler mappings defined in the web.config.

Or you can have an HttpModule do it.

However, since you are already using asp.net (to judge from your tags) and you've only one exception, then an easier way is probably just to do it at that level. If not, the logic is much the same for doing this from an HttpModule.

In your page-base class (if you don't already define an abstract class in between System.Web.UI.Control.Page and your own pages it might be worth looking at, it's a handy place to put commonly used methods) put a virtual member that gets called before the main page-load handler (e.g have a method called OnLoad that calls this and then your "real" page-load method).

In this method, check the http method used, and if it's not correct set the status code to 405, output an error page for bonus marks, and then stop all processing.

In your page that allows get, override and change the method you check for.

If your class structure doesn't allow this to be done easily, then the HttpModule approach will be easier. Here you'll have to examine the URI to know which method to allow, but the rest is pretty much the same.