我只有在Java中解决这个问题的经验，但我希望我的解决方案有一些到.NET的转换，这对您有帮助。Fortify的WebInspect扫描程序报告了“HTTP方法覆盖”。为了解决我的团队的问题，我实施了一个过滤器来侦听错误的标头（x-http-method，x-http-method-override，x-method-override），将状态设置为405，如果发现它们则中断。请参见下面的代码。我知道这不是最优雅的解决方案，但它是我找到的唯一一个满足扫描的（抛出错误并引导用户不满足）。

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest hsReq = (HttpServletRequest) req;
    HttpServletResponse hsRes = (HttpServletResponse) res;

    hsRes.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
    hsRes.setHeader("Pragma", "no-cache");
    hsRes.setDateHeader("Expires", 0);
    hsRes.setHeader("X-XSS-Protection", "1; mode=block");
    hsRes.addHeader("X-Content-Type-Options", "nosniff");
    hsRes.setHeader("Content-Security-Policy", "frame-ancestors 'none'; default-src *; style-src 'self' http://* 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'");
    hsRes.setHeader("X-FRAME-OPTIONS", "DENY");
    hsRes.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains;");

    // This resolves "Often Misused: HTTP Method Override"
    hsRes.setHeader("Access-Control-Allow-Methods", "GET, POST");
    String methodParam = hsReq.getParameter("_method");
    if (methodParam != null){
        LOG.error("\n Bad actor is attempting to use HTTP Method Tunneling. \n");
        hsRes.reset();
        hsRes.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
        return;
    }
    String xhmHeader = hsReq.getHeader("x-http-method");
    String xhmoHeader = hsReq.getHeader("x-http-method-override");
    String xmoHeader = hsReq.getHeader("x-method-override");
    if ((xhmHeader != null) || (xhmoHeader != null) || (xmoHeader != null)){
        LOG.error("\n Bad actor is attempting to use HTTP Method Tunneling. \n");
        hsRes.reset();
        hsRes.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
        return;
    }

    chain.doFilter(req, res);
}

我在另一个stackoverflow问题上找到了这个解决方案：

https://stackoverflow.com/questions/66032991/how-do-i-ensure-that-x-http-method-headers-are-ignored

简而言之，这是最普遍接受的答案的问题，这是添加到您的web.config：

<system.webServer>
    ...
 <security>
      <requestFiltering>
        <requestLimits>
          <headerLimits>
            <add header="X-Http-Method-Override" sizeLimit="0" />
            <add header="X-Method-Override" sizeLimit="0" />
            <add header="X-HTTP-Method" sizeLimit="0" />
          </headerLimits>
        </requestLimits>
        ...
      </requestFiltering>
    </security>
   ...
  </system.webServer>