Secure my web services

Question

I have some web services.

They are used by a silverlight application and on their own by other apps.

What is the best way to secure these so that hackers cannot access them directly?

Currently they are blocked to localhost only then the silverlight application calls the web application and the web application calls the web services itself.

I hate this solution because it adds another layer and there is a performance hit.

Do not want to change the web service code if at all possible.

Answer 1

Have you tried simply changing the configuration of the service and client to use basicHttpBinding with SSL?

I don't know enough about SilverLight to know if it supports wsHttpBinding, but you might try that as well.

Answer 2

• IIS can be configured to only allow connections from specific IP Addresses. I'd configure your webservices this way first.
• Also, if you're using WCF you can use https and certificates to manage security right in the WCF endpoint configuration tool

I would use one or both of these methods myself.

Answer 3

If you are using ASP.NET and WCF, you can use the built in ASP.NET authentication and put the ASP.NET authentication required tag on your webservices. There is a great screencast about it here.

Answer 4

Here's my favorite reference on the subject.

http://timheuer.com/blog/archive/2008/10/14/calling-secure-services-with-silverlight-2-ssl-https.aspx

In short, use basicHttpBinding (or customBinding in Silverlight 3) with https. Works like a charm combined with ASP.NET Application Services. Here's a good overview of Silverlight http security:

http://msdn.microsoft.com/en-us/library/cc838250(VS.95).aspx