How do I restrict POST access to a HttpHandler?

Question

I have a few http handlers ( IHttpHandler ) in my asp.net web project. Now I want to restrict access to these handlers. For Handler1 I want to allow only POST requests, and for Handler2 I want to allow only GET requests.

In my web.config I modified the <httpHandlers> section as shown below, but both handlers still process all verb types. Is there something I've missed? I'm testing it using IIS Express.

<httpHandlers>
  <add verb="POST" path="Handler1.ashx" type="MyNamesapce.Handler1, MyAssembly"/>
  <add verb="GET" path="Handler2.ashx" type="MyNamesapce.Handler2, MyAssembly"/>
</httpHandlers>

Answer 1

The reason this isn't working for you is that you've conflated two slightly different "flavours" of something that implements IHttpHandler .

There are two ways that you can implement an IHttpHandler with asp.net:

• Create a class that implements IHttpHandler , eg MyCustomHandler.cs . This type of handler won't respond to any requests without being configured in your web.config file.
• Create an .ashx file (which it looks like you've done), eg MyOtherHandler.ashx . This type of handler will respond to any requests to its URL, eg http://localhost/MyOtherHandler.ashx

The first type requires entries in the web.config file to work, the second doesn't. This is why you're seeing your .ashx handlers responding to all HTTP verbs, because they're being handled by the part of the asp.net framework that responds to requests for .ashx files, rather than being triggered by your web.config file. If you're using IIS Express, you can see this configured in the file %USERPROFILE%\\Documents\\IISExpress\\config\\applicationhost.config . Search for ".ashx" and you'll find a line similar to the below in the <system.webServer><handlers> section:

<add name="SimpleHandlerFactory-Integrated-4.0" path="*.ashx"
     verb="GET,HEAD,POST,DEBUG" type="System.Web.UI.SimpleHandlerFactory" 
     preCondition="integratedMode,runtimeVersionv4.0" />

This is equivalent to what you've been adding to your web.config, but is responsible for telling IIS/asp.net "respond to any URLs that end in .ashx with any of the listed verbs by having the code in the type System.Web.UI.SimpleHandlerFactory deal with it. This code then loads your .ashx file.

To create a handler that can respond to any address you choose, you need (in short) a .cs file containing something similar to:

using System.Web;

namespace HttpHandlers
{
    public class Handler4 : IHttpHandler
    {
        public bool IsReusable
        {
            get { return true; }
        }

        public void ProcessRequest(HttpContext context)
        {
            context.Response.Write("Hello World from Handler4.cs");
        }
    }
}

You can then wire it into your web.config file with:

<add name="Handler4" verb="POST" path="Handler4.ashx" type="HttpHandlers.Handler4, HttpHandlers" />

NOTE: My project that I created to test this is called "HttpHandlers", hence the type declaration that I've specified in that web.config snippet.