Securing web service

[John]

Hi

How can I make sure that no one else can call and receive data from my web
methods?

Thanks

Regards

[Dale]

Turn the server off.

"John" <jo**@nospam.infovis.co.uk> wrote in message
news:#s*************@tk2msftngp13.phx.gbl...

Hi

How can I make sure that no one else can call and receive data from my web
methods?

Thanks

Regards

[R.Balaji]

That was a nice joke. LOL.

Well, I assume that you don't want to give access to your webservice to the
unauthorized users.

1.Use sessions in your web methods in application layer
2.Use SSL in transport layer

More can be found under
http://msdn.microsoft.com/library/de...SecNetch10.asp
http://msdn.microsoft.com/library/de...OAPHeaders.asp

Regards,
R.Balaji
"Dale" <da************@msndotcomNot.Net> wrote in message
news:ua**************@TK2MSFTNGP10.phx.gbl...

Turn the server off.

"John" <jo**@nospam.infovis.co.uk> wrote in message
news:#s*************@tk2msftngp13.phx.gbl...

Hi

How can I make sure that no one else can call and receive data from my web methods?

Thanks

Regards

[John Jenkins]

You could only send the wsdl defining your service to the people who are
entitled to use it, i.e. Don't publish the WSDL which would include endpoint
details etc.

Additionally you could look at implementing WS-Security frim MS. This would
validate any user who tried to use your service. The implementation is very
straightforward..
Search for "WS-Security Authentication and Digital Signatures with Web
Services Enhancements" in msdn.
"John" <jo**@nospam.infovis.co.uk> wrote in message
news:%2***************@tk2msftngp13.phx.gbl...

Hi

How can I make sure that no one else can call and receive data from my web
methods?

Thanks

Regards

[Michael Pearson]

I've always put a username / password params in each of my web methods. I
then validate the user on each method call, and THEN do the real work of the
web method.

You can authenticate that username / password against a hardcoded value, a
database value, or a web.config value.

Michael

"John" <jo**@nospam.infovis.co.uk> wrote in message
news:%2***************@tk2msftngp13.phx.gbl...

Hi

How can I make sure that no one else can call and receive data from my web
methods?

Thanks

Regards

[Gerald Brose]

John wrote:

How can I make sure that no one else can call and receive data
from my web methods?

Rather than hardcoding security logic into your applications
(as described in separate answers in this thread) you can use
a separate SOAP Firewall that allows you to

- integrate security transparently (i.e. without modifying
application code) even in multi-vendor deployments

- manage your security policies centrally, using a professional
admin console GUI

You may want to take a look at Xtradyne's WS-DBC (Domain Boundary
Controller), which delivers comprehensive security and enterprise-
grade performance. See http://www.xtradyne.com for more info.

Regards, Gerald.
--
Dr. Gerald Brose mailto:br***@xtradyne.com
Xtradyne Technologies http://www.xtradyne.com
Schoenhauser Allee 6-7, Phone: [phone]
D-10119 Berlin, Germany Fax : [phone]

[Tony]

Your username/password can be viewed by attacker, if your transport is HTTP.
Then he can do something else after obtain username/password. He can also
changed the request message with know what's the meaning of original message,
withoud detected by your web service. Best way is to go with SSL using client
certificate as security token, to encrypt and sign message. search WSE in
MSDN.

"Michael Pearson" wrote:

I've always put a username / password params in each of my web methods. I
then validate the user on each method call, and THEN do the real work of the
web method.

You can authenticate that username / password against a hardcoded value, a
database value, or a web.config value.

Michael

"John" <jo**@nospam.infovis.co.uk> wrote in message
news:%2***************@tk2msftngp13.phx.gbl...

Hi

How can I make sure that no one else can call and receive data from my web
methods?

Thanks

Regards