asp.net - Login Form Using HEAD or OPTIONS Verb Instead of POST -

i have strange problem. deployed application production. have 2 action methods logging in:

accountcontroller    [httpget]login();    [httppost]login(..); 

the form rendered capture login information , perform post straightforward form:

<form action="/account/login" class=" form-horizontal" method="post" novalidate="novalidate"><input name="__requestverificationtoken" type="hidden" value=".."> . . </form> 

i log unhandled actions on controller, writes message event log. message see:

protected overrides sub handleunknownaction(actionname string)     eventlog.writeentry("application", "controller '" + me.gettype().name + "' not have action '" + actionname + "' request of type '" + me.controllercontext.httpcontext.request.httpmethod + "'.") end sub 

i see message logged:

controller 'accountcontroller' not have action 'login' request of type 'head'. controller 'accountcontroller' not have action 'login' request of type 'options'.

any idea why request coming on head or options? have no idea how user trying connect application.

to sure should check user agent string logged request (if available) i'd bet it's bot inspecting home page (possibly redirected login page).

see googlebot head request. i'd discourage user agent string filtering unless want keep up-to-date topic (and anyway bad bot may fake search engine spider's user agent string).

they usually go normal request bots (as attempt optimize bandwidth usage?) first tries head , options.

you have afaik 2 options: provide specific controller method handle them (if care) or instruct bots using robots.txt file. if leave as-is shouldn't have trouble both security , seo point of view (most bots go get if receives 405 head , options).

what's right thing do? if care i'd handle them returning http status 405 (not allowed). suggests http status 501 (not implemented) may proper/better response.

mvc correctly returns method not allowed unsupported request method , fills (mandatory) allow field in response (in case allow: get,post), behavior equivalent code:

[actionname("login")] [httpoptions, httphead] public actionresult loginforunsupportedhttpmethods() {     return new httpstatuscoderesult(httpstatuscode.methodnotallowed); } 

if you're not using asp.net mvc 5 don't have httpstatuscode enumeration , have specify return code manually: new httpstatuscoderesult(405).

however not every bot/spider/service correctly switches get if head isn't supported (notable example downforeveryoneorjustme.com) may want return page head (and leave default behavior options):

// method isn't required unless want return different // http status code or perform special operation. [httpoptions, actionname("login")] public actionresult loginforunsupportedhttpmethods() {     return new httpstatuscoderesult(httpstatuscode.methodnotallowed); }  [httpget, httphead] public actionresult login() {/* ... */ }  [httppost] public actionresult login(loginmodel model) {/* ... */ } 

optimization: if you're running high traffic web-site, you're regularly requested many head , (in measurable way) affect site performance may decide return stripped down version of page head requests (possibly without server side processing , possibly unused client side stuff css , scripts).