Disable HTTP Options method in ASP.Net Core 3.1

Question

We have a requirement of disabling the HTTP OPTIONS method in an ASPNET Core Web application due as a part of security fixes. How can we disable the HTTP OPTIONS method in ASP.Net core 3.1 API?

Answer 1

Here is a demo with middleware: Add this to your startup Configure:

app.Use(async (context, next) =>
{
    // Do work that doesn't write to the Response.
    if (context.Request.Method=="OPTIONS")
    {
        context.Response.StatusCode = 405;
        return; 
    }

    await next.Invoke();
    // Do logging or other work that doesn't write to the Response.
});

result:

Or you can apply [HttpGet] [HttpPost] [HttpPut] ... on your action method in controller.Here is an official document about the Http Verbs.