Is it possible to secure a web service with Forms Authentication?

Question

We are looking to secure a bunch of ASP.Net 2.0 .asmx web services. The which will host the web services is already forms authenticated.
Is it possible to secure the web services using forms authentication? What are the pros and cons and other possible ways to achieve this. We certainly don't want to pass a username/pwd or token in each web method call.

Answer 1

It is possible, but you will need to redirect users to a login page. Another option for passing username/pw is to use the web service over ssl. If you encrypt the connection, basic authentication can be used no problem.

Answer 2

The thing with forms authentication is that its designed for people, where as a web service is designed to be consumed by a client application. While it is possible to do the authentication like this its the wrong way of thinking.

The level of secure obviously depends upon the sensitivity of data that you're working with, but I'm going to assume its at least somewhat secure (but less than bank transactions). You could perhaps use SSL and passing a username and password as jle suggested, while I was typing this, or you could require an api key much like flicker does.

Another more secure option is to only pass the username and password once (and with the security of ssl) and have that give out a token that is valid for a period of time. This has the benefit of protecting the password information, and avoiding the constant overhead of ssl.

As mentioned though, it highly depends on HOW sensitive the information is that you're trying to secure.

Answer 3

You should be able to use WSE to secure your service using forms authentication - though personally I've never had to do it.

Here are some resources using WSE:

• http://aleemkhan.wordpress.com/2007/09/18/using-wse-30-for-web-service-authentication/
• http://msdn.microsoft.com/en-us/library/aa480575.aspx

To not use WSE you'd need to implement something like this as some of the other presponders have alluded to, though I'm not sure how reliable it would be:

• http://www.dotnetbips.com/articles/dbd724e9-78f0-4a05-adfb-190d151103b2.aspx

Answer 4

WSE is obsolete. Do not use it unless you have no choice at all.

Almost all the functions of WSE are implemented better by WCF. The remaining capabilities, those not implemented by WCF, are obsolete themselves (DIME, for instance).