How to secure a webservice in .net?

Question

Hi everyone,

I have written a simple .NET webservice, which I will be hosted on a different server may be on different continent. I don't really know. Now, I only had its URL and I tried to use webrequest and webresponse method to access that web service vai HTTP POST. Now, I want to know is there any way to secure the webservice access, so that nobody can exploit it?

for example: My webservice which is here.

http://consultflux.com/Verify/Verification.asmx/Verify?AccountNumber=3223&ProductName=876

Now, these are all the parameters required to call this webservice. As if now, anyone can exploit it. So how can I make it secure? Although, I am planning to get SSL and this whole thing is happening from server to server, not from client to server?

Answer 1

You can pass a service key (much like Amazon WS) in the authorization header of the web request which could be encrypted with an algorithm of your choice, which is then decrypted at the service end and only continue with the execution if the key matches

See section 14.8 in the following URL

http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html

Answer 2

Unfortunately, you don't have many options since you've used the old ASMX web service technology. The only ways to authenticate someone with ASMX web services, over the Internet, basically amount to "do it yourself".

If I had to do this, I'd use WCF and give myself some options. If I couldn't use WCF, then I'd create a custom HTTP header to pass username and password (over SSL!), and authenticate them on the server. Alternately, I'd use certificates on the client and require them to be sent to the server. IIS can even turn client certificates into Windows identities on the server.

Answer 3

Typically what you used to secure .NET web services before WCF was Microsoft's Web Service Extensions (WSE), now at version 3.0. I have used it successfully in a commercially-available product, and it is rather good as it is based on the W3C ws-* standards. It is possible to successfully interoperate with that from .NET clients (obviously) but also from Java clients if you use Apache Axis. Download at:

http://www.microsoft.com/downloads/details.aspx?FamilyID=018a09fd-3a74-43c5-8ec1-8d789091255d&displaylang=en

Answer 4

We do a fair number of Web services and to secure them we just added a username and password to our request object. In your case you could just add 2 new parameters for a user name and password, or more simply just add one and use something like an authentication code, that you can make as complex or as simple as you want.

Some Ideas are something simple like a list of GUIDs that are acceptable pass keys to an encryption of the requesting servers IP address so that authentication code only works with that IP address verified by the web service.