views:

345

answers:

3

I have an ASP.NET (1.1) web service which authenticates clients using a SoapExtension.ProcessMessage(SoapMessage) override as described in:

http://www.codeguru.com/columns/experts/article.php/c5479

However if the web.config if not set up such that HttpSoap is the only protocol allowed, then ProcessMessage will never get called for requests coming in on other protocols, and therefore bypass security.

Is there anyway to programatically ensure SOAP is being used (as opposed to relying on the web.config to be correct)?

Thanks.

A: 

Look in Request.ServerVariables, specifically the SERVER_PROTOCOL variable.

http://www.aspcode.net/List-of-RequestServerVariables.aspx

Joel Coehoorn
Won't SERVER_PROTOCOL contain "HTTP/1.1" whether or not HttpSoap is in use?
Yes. I misread the question and I'm used to just checking between http or https. You might still find the link helpful, but probably not as much as I'd hoped.
Joel Coehoorn
A: 

You could try to read and parse the web.config at startup, to see if it's set the way you'd like it to be.

John Saunders
+1  A: 

If it's of any use to anyone, I ended up checking:

Request.ServerVariables["HTTP_SOAPAction"] != null

which isn't ideal but seemed to do the trick.