RequestFiltering value for http verbs in applicationhost.config can be overridden in my websites?

Question

What will happen to my website when configure http [OPTIONS=true] in web.conig if http OPTIONS is already configured in applicationhost.config as [OPTIONS=false]?

ApplicationHostFile => added http OPTIONS = false My website level web.config => adding http OPTIONS = true

Which one will take priority? & will get any issue [server error] while launching my website?

[Ex: We will get error saying that "duplicate' not allowed if add http response header in applicationhost.config. So something like we will get any error for RequestFiltering http verbs when both file have same headers?]

Answer 1

If HTTP verbs configured in Applicatiohost.config file like,

<system.webServer>
   <security>
    <requestFiltering>
      <verbs allowUnlisted="true" applyToWebDAV="true">
         <add verb="OPTIONS" allowed="false" />
      </verbs>
     </requestFiltering>
   </security>
 </system.webServer>

this can be overridden in our website web.config section by configuring like,

<system.webServer>
   <security>
    <requestFiltering>
      <verbs>
         <remove verb="OPTIONS" />
         <add verb="OPTIONS" allowed="false" />
      </verbs>
     </requestFiltering>
   </security>
 </system.webServer>