title: How to disable the use of verb tunneling using such headers or query parameters in .NET?
body: <p>I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as GET and POST.</p>
  <p>The scan is sending these headers to an endpoint that accepts POSTs:</p>
  <pre><code>X-HTTP-METHOD: PUT
  X-HTTP-Method-Override: PUT
  X-METHOD-OVERRIDE: PUT
  </code></pre>
  <p>I've done a lot of researching and am having a hard time finding a way to &quot;disable&quot; verb tunneling. It seems that these methods need to be allowed, not the other way around.</p>
  <p>For example, in .NET the HttpMethodOverrideExtensions method is what allows these types of headers. I'm see multiple tutorials on how to allow the three headers posted above.</p>
  <p>Am I correct in my response saying the application by default does not allow verb tunneling, as the methods to allow it are not in the application's code base?</p>