c# - HEAD request fails with System.Net.ProtocolViolationException when using AuthorizeAttribute in WebApi2 + Owin -

i developing restful api need check authorization before making actual delete request. thought nice use head method preflight check.

i expected unauthorized request head method return 401/403 response no body. however, turns out webapi2 crashes following exception , closes connection:

exception caught: 'system.net.protocolviolationexception' in system.dll ("bytes written stream exceed content-length bytes size specified.") 

other http methods (delete,get) seem work - return 401 response.

i can workaround request, seems bug in webapi. authorizeattribute adds content, no matter original request method was.

my question is: bug or intended behavior , there reason why shouldn't use head method here?

here sample program reproduces issue:

namespace owinserver {     [authorize]     public class valuescontroller : apicontroller     {         // api/values          public ienumerable<string> get()         {             return new[] { "value1", "value2" };         }          //head api/values         public void head()         {          }          //delete api/values         public void delete()         {          }     }      class program     {         static void main(string[] args)         {             var baseaddress = "http://localhost:9000/";              // start owin host              using (webapp.start(baseaddress, configuration))             {                 console.writeline("host started");                 console.readline();             }         }          public static void configuration(iappbuilder appbuilder)         {             // configure web api self-host.              var config = new httpconfiguration();             config.routes.maphttproute(                 name: "defaultapi",                 routetemplate: "api/{controller}/{id}",                 defaults: new { id = routeparameter.optional }             );              appbuilder.usewebapi(config);         }     } } 

the behavior can tested using powershell:

sample request fails:

invoke-webrequest -uri 'http://localhost:9000/api/values' -method head 

sample request works:

invoke-webrequest -uri 'http://localhost:9000/api/values' -method delete