confused about webservice AJAX calls security in ASP.NET

Question

hi, excuse me if i will sound little stupid but this thing had confused me to the core and i have been searching like crazy on net with no ultimate answer so i hope some one would shed more light on this matter.

now i wanna create a portal site and my client require that everything should be AJAX'ed so i have been playing with ASP.NET AJAX 4 and client site templating and web service, and of course the performance is great with JASON results, but my web Service code will be Public because anything available to JAVA script is available to anyone so as i read to avoid this i must :

• use SSL but this is a portal site and front end should not use SSL
• Authentication, will this is fine but for back-end and not front-end as login is not required.

after reading a lot as i have mentioned, i have come to the following pitfalls when using web service with AJAX and hope there is a solution or at least a way to bring more security

DOS: i have read some articles that suggest you should throttle using IP detection and block this request for a while but here are some of the things i am worried about

• will it affect search engine crawlers ?
• will the hacker be able to bypass this by using proxy or other mean ?

Session HighJacking: this is scary i still don't know how this can happen when you are using ASP.NET membership, i thought it is a pretty solid membership system! and will a hacker be able to steal someones pass through this method?

a way to hide your code or encrypt it: i think i am making a fool of myself here because i have mentioned that if it is public to java script then it is public to anyone, but my client would not want people to see the code writing logic and function.

Hide Webserivce: like if you use fiddler you can see in the RAW data the path to for example www.mysite.com/toparticles/getTopArticles(10) again this scares my client and i have tried to disable WSDL and documentation in webconfig but this only blocks direct access to the file and nothing more or am i wrong! is there a way to hide the path to web service?

so all in all my top concerns is to prevent hammering any of my web services and hide my code as much as possible.

so am i to paranoid as on the front end i am going mostly to be pulling Data but again i may give user the option to save for example his widget preferences in DB, etc... and it is not gonna be through SSL thus the above security threats are valid.

i hope some one can also share his experience on this matter, thanks in advanced.

Answer 1

Any functionality exposed on the web is going to be, well... exposed on the web. Even if you were using pure ASP.NET with postbacks, sniffers can see the traffic and mimic the postbacks, Ajax just takes that to its logical extreme. Webservices are (for the most part) just like any other get/post system (RESTful or not).

There are some methods that you can use to secure your webservices from unauthorized access, but in truth these are the exact same things you would do to secure any other site (asp.net, traditional web, etc).

There are lots of articles all over the web about how to secure your website, and these will apply equally well to AJAX, Webservices, etc.

If you are really concerned about your webservices being publicly exposed, you can use your own custom reverse proxy to hide the services inside the customers network and only expose the proxy to the outside world. You can then secure the services so they are only accessed through the proxy and provide whatever appropriate security on the proxy you feel relevant. In this way all traffic comes through servers that you specify and is restricted (to a reasonable degree) from prying eyes. In general though I think this might be over-kill especially for a portal site.

One thing to talk with your client about is the upsell value of using webservices as a sellable product to integrators. In other words, designing the security into the webservices and using the portal only as an example of how to put it all together. A clear example of this is SharePoint, which is in truth a collection of webservices and processes and the website is really just for convenience, the power of SharePoint is in the interop of the services.

For more specific answers to your security questions, there are plenty of posts here on SO as well as the web covering each of your specific points.