Is PUT broken by default in ASP.NET MVC?

Question

I created a new ASP.NET MVC project, updated NuGet packages (to <package id="Microsoft.AspNet.Mvc" version="5.2.3" targetFramework="net451" /> ) and added a controller:

public class HomeController : Controller
{
    [AcceptVerbs(HttpVerbs.Get | HttpVerbs.Put | HttpVerbs.Post)]
    public string Index()
    {
        return "bombaclat";
    }
}

I ran it on IIS Express and found out that PUT returns 404 from IIS StaticFile handler (both GET and POST works just fine).

I can fix it either by allowing all verbs for ExtensionlessUrlHandler:

<system.webServer>
  <handlers>
    <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
    <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
  </handlers>
</system.webServer>

Or by running UrlRoutingModule for every request:

<system.webServer>
  <modules>
    <remove name="UrlRoutingModule-4.0" />
    <add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" preCondition="" />
  </modules>
</system.webServer>

(and so, setting RAMMFAR to true will work as well)

1. Is it by design that I need to mess with Web.config to make PUT work?
2. Are the solutions equivalent? If no, what are the differences, and how should I decide which one to use?
3. Is there a reason PUT is disabled for ExtensionlessUrlHandler by default?

(just in case: I'm on Windows 8.1 Enterprise, VS 2013, IIS 8).

---

UPD: If you tick WebApi when creating the project, VS will add the ExtensionlessUrlHandler config part. So, I guess it's safe to use it

Answer 1

I have never seen other mentions of security, but the issue I myself and other colleagues have run into (usually once per person :)) is the WebDAV issue mentioned by Slicksim

You could try this in your web.config:

<system.webServer>
  <modules>
    <remove name="WebDAVModule" />
  </modules>
  <handlers>
    <remove name="WebDAV" />
    <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
    <remove name="OPTIONSVerbHandler" />
    <remove name="TRACEVerbHandler" />
    <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
  </handlers>
<!--all the other webserver stuff -->
</system.webServer>

I suppose you could also remove WebDAV completely from your IIS, but I think the above is enough.