IIS REST Verbs give 404 and 401

I'm writing a REST service implemented in a single ashx handler class that was added to an initially empty ASP.NET Project. I test drive the service by using Fiddler's convenient Compose feature where you can send a http request and see the response.

404 Not Found

My GET and POST requests all work, but PUT and DELETE return status 404 from IIS and my code is never reached. I found it was necessary to go to IIS Manager > Web Site (or app) > Handler Mappings > double-click SimpleHandlerFactory-Integrated-4.0. In the dialog click Request Restrictions > Verbs tab > add PUT and DELETE and any other verbs you desire to the comma joined list.

401.3 Access is denied

I've overcome the 404 but now I get a security violation. Mercifully the default body of the response tells me it's a 401.3 which is an ACL violation on the ashx file. Procmon unexpectedly does not show me any Access Denied events to help me diagnose the violation. After a few experiments I conclude that you have to give Authenticated Users Read and Write permission to the ashx file.

And there goes another hour of my life I'll never get back.

---

Addendum March 29th 2016

A brand new small REST service was giving 404 for all DELETE verbs on my live server, not in development. I followed the instructions above but it made no difference. Then I noticed the Web.config file had a <system.webServer> <handlers> sections which was commented out. Inside it removed and added ExtensionlessUrlHandler-Integrated-4.0 allowing all verbs. I uncommented the section and now the deletes started working.

I presume I could also have edited the corresponding handler in the IIS configuration dialogs, but not this time.

Orthogonal Programming