A question about WebMethods

Question

Hello, I have a page and it has webmethods I can use theese from the aspx page via ScriptManager, I am wondering If anyone can access theese methods from the outside of the page,if it is how can I secure the WebMethods ?

Answer 1

Yes adding the WebMethod attribute makes that method remotely callable, meaning that you can call it using javascript for example. Simply put you shouldn't expose WebMethods that you do not want third parties to be able to call. But for some more information regarding security and webservices, refer to: http://msdn.microsoft.com/en-us/magazine/cc188947.aspx

Answer 2

Securing the web methods completely isn't possible. After all, if you're accessing them from your web page, they are being accessed directly from the client browser.

You could add an extra parameter that needs to contain some kind of one-time password / token and generate one when the page gets rendered. That will make it more difficult for someone to continue using your webservice without actually visiting your site.

Answer 3

Your web methods will have the same sort of security as your web pages. If you need to make sure they are being accessed securely, check for a valid session, authenticated user, etc. before allowing the action. The request to the web method should include the various cookies required to determine if the user making the request has been authenticated. Based on the identity of the authenticated user, their roles, etc. you can determine if the request should be processed. If you are using the web config to secure your pages, the security applying to the page ought to also be applied to web methods on the page.

Note that you can't guaranteed that someone won't simply issue the request independent of a browser (i.e., that the request is always from within your application's UI). You need to do the same sorts of security checks that you would for any of your pages.

Note here that I'm talking about securing web methods added to an ASPX page. For web services, authentication and authorization may be handled completely differently. For examples, credentials may be required with every request and may be part of an "envelope" or a parameter on the method itself. Securing web services is probably a subject for a question of its own.