Securing a Web Service

Question

I have a Web Service (ASMX) with a few Web methods on our production Web server. On a separate internal Web server (which isn't publicly exposed) I have another Web site that will use the ASMX's public web methods. What are some of the best ways to secure the Web service such that only the internal Web server can access the Web Services running on the publicly exposed Web server?

Answer 1

Assuming you don't have the option of using WCF, I'd advocate using WSE 3 (Web Service Enhancements). You can get the toolkit / SDK thingummy at MS's site

To limit the access to only internal machines (as I think your question asked), I'd set up a separate web site in IIS and set it to only respond to the internal IP address of your server.

Answer 2

I would set a firewall rule to restrict access to a whitelist of IP addresses.

Answer 3

Use IIS's directory security IP address restrictions, and limit access to just that internal web server IP address.

If you can't do that then, and you can't setup a username/password on the directory, then use WSE and add a username/password into the service, or look at certificates if you want some fun grin

Answer 4

Maybe I did not understand correctly, but why expose the web methods publicly at all if they're only going to be consumed by the internal server?

Answer 5

In this moment what comes to my mind is IP filtering on IIS. Fast to apply, should work in your scenario.

Answer 6

TLS with client certs. See Wikipedia entry to get started.

Answer 7

A simple HTTP module will work. Just hardcode (or from config) the allowed IP/host and reject all others.

Answer 8

One of the easiest ways is to pass credentials in the soap header of the message. So each call passes along the info needed to determine if the user is authorized. WSE makes some of that easier but one of the most succinct descriptions of this process can be found in Rocky Lhotka's book on Business Objects. I get a lot of books to review by publishers and this one had the best explanation

Answer 9

Be aware that there are ways around whitelisting IPs. Don't get me wrong, it's a great idea, and you should definetly do it, but if your budget/resources allow it, you can expand your threat model.

Answer 10

If it is only the internal server that will be accessing the asmx files? You could set them up in IIS under a separate web site or virtual directory, then place some IP restrictions on the site. In properties, go under Directory Security, then "IP Address and Domain Name Restrictions."

Also, for passwords, WSE 3 is the new go-to, but I did find a simple method in a book from Apress called "Pro ASP.NET 2.0 in C# 2005" Chapter 34. (Note, the newer version of this book omits this chapter.) The section is custom Ticket-based authentication.