How do I restrict the WCF service called by an ASP.NET AJAX page to only allow calls for that page?

Question

I have an AjaxControlToolkit DynamicPopulate control that is updated by calls to a WCF service. I know I can check the HttpContext in the service request to see if a user of the page (and thus, the control) is authenticated. However, I don't want anyone clever to be able to call the service directly, even if they're logged in. I want access to the service to be allowed ONLY to requests that are made from the page. Mainly, I don't want anyone to be able to programatically make a large number of calls and then reverse-engineer the algorithm that sits behind the service.

Any clever ideas on how this can be done? Maybe I'm over-thinking this?

Thanks in advance.

Answer 1

The simple answer is you can't. The complicated answer is you can fudge it with a lot of work, you could for example

1. Rate limit based on the IP of the caller.
2. Drop a cookie based upon the session and rate limit on that.
3. Drop a cookie based upon the page when the page loads and rate limit upon that.

However none is foolproof, and all can go wrong with legitimate requests.

Answer 2

If you really want to restrict this to just this one server making the request, you could add a certificate to that server and check for that certificate. However, you probably can't really limit access to just a single page calling your service.

You could add a lot of additional elements, like headers etc. - but none will really be totally sound - if someone is determined enough, they'll be able to figure out what you're doing, and replicate that.

So really: why do you need to limit this access this badly?