Is it bad to have 'You have created a service' page for published wcf service on the internet?

Question

Hello,

I have created wcf service and planning to make it accessible from the internet. The page 'You have created a service' seems to be some stub which should be replaced before putting service on production. Is it a bad practice to have this welcome page on production? What do you do with that welcome page when you publish wcf services on the internet?

Thanks

Answer 1

Yes, it's bad. It says potential attackers that the system is non-configured completely, so they would try to attack it. Also, it's not very professional.

Well, print something useful there or hide it:-)

Answer 2

On production you can turn off this page by adding:

<behaviors>
  <serviceBehaviors>
    <behavior name="ProductionService">
      <serviceDebug includeExceptionsInDetail="false" httpHelpPageEnabled="false" />
    </behavior>
  <serviceBehaviors>
</behavirs>

Also think about publishing WSDL / Metadata. If you don't want to publish WSDL but you want to use mex endpoint use following configuration:

<behaviors>
  <serviceBehaviors>
    <behavior name="ProductionService">
      <serviceMetadata httpGetEnabled="false" />
      <serviceDebug includeExceptionsInDetail="false" httpHelpPageEnabled="false" />
    </behavior>
  <serviceBehaviors>
</behavirs>

Your services must use those behavior in their behaviorConfiguration attribute.