ASP.NET Web Service Security

Question

I've built ASP.NET Web Services in the past that either were publicly consumed, or used Windows Authentication. I now need to build a Web Service that uses the SOAP 1.1 protocol and it needs to be secured with a username and password from the caller.

It seems setting up the infrastructure for WCP is overkill for one or two Web Services. Any other suggestions? I was also thinking of using ASP.NET 4.0 Beta, if anyone has explored that for this scenario, it would be helpful to know your opinion.

Thanks in advance for your suggestions.

Answer 1

The simple way is to create a special header that carries the auth info for every call and authenticate/authorize the user that way

Here's some sample code: http://aspalliance.com/805_Soap_Headers_Authentication_in_Web_Services

Note that in this way you are sending clear text username and password so you would want to use ssl or use some kind of digest authentication

Answer 2

There are different ways of doing this. One could be enabling access to a specific sets of IPs. If the IP doesn't match one of the lists then you could easy reject the call at method's level.

Otherwise, you could create another method that would return a token and then make all the relevant methods to expect that token in return in order to process the request.

Answer 3

Use SSL. Force everyone who consumes your webservice to use https.

        //Check for Secure Channel: HTTPS
        if (!Context.Request.IsSecureConnection) 
            return "The HTTP Connection must use Secure Sockets (HTTPS)";