Disable HTTP Options method in ASP.Net Core 3.1

Question

We have a requirement of disabling the HTTP OPTIONS method in an ASPNET Core Web application due as a part of security fixes. How can we disable the HTTP OPTIONS method in ASP.Net core 3.1 API?

Answer 1

Here is a demo with middleware: Add this to your startup Configure:

 app.Use(async (context, next) =>
            {
                // Do work that doesn't write to the Response.
                if (context.Request.Method=="OPTIONS")
                {
                    context.Response.StatusCode = 405;
                    return; 
                }

                await next.Invoke();
                // Do logging or other work that doesn't write to the Response.
            });

result:

Or you can apply [HttpGet] [HttpPost] [HttpPut] ... on your action method in controller.Here is an official document about the Http Verbs.