How to restrict web service invokation to a few known web sites?

[Andrew V]

Greetings,

I need to create a web service to be called by a few of our external
affiliated web sites. How can I restrict web service invokation to only
these affiliated web sites?

Some of the things I came up with, but seems weak
1. Check caller's url and only accept those that are in a list of authorized
web sites. But hacker can spoof the url
2. Give each site a user name and password to send over with every call. But
we can't count on them to secure this info appropriately
3. Using x509. But that seems to be overkill. We would consider this as the
last resort.

The one thing I will stick to is requiring the web service to be called over
SSL. Unless there is some draw back to that.

Please share with me your thoughts and recommendation. Many thanks in
advance.

[Martin Kulov [MVP]]

"Andrew V" <aa*@aaa.aaa> wrote in message
news:OW**************@TK2MSFTNGP04.phx.gbl...

Greetings,

I need to create a web service to be called by a few of our external
affiliated web sites. How can I restrict web service invokation to only
these affiliated web sites?

Andrew,

you can use IIS security setting to set only allowed IP addresses to access
the web application (service).
SSL will require you to buy client certificates for each client which may be
not the best solution.

Regards,

--
Martin Kulov
http://www.codeattest.com/blogs/martin

MVP, MCT, MCSD, MCPD

[Andrew V]

Thanks for replying Martin.

I'm worry that allowing access by ip is not strong enough as a hacker can
spoof the ip. What's your assessment of that threat?

Thanks,
Andrew.

"Martin Kulov [MVP]" <ku***@bezbokluk.abv.bg> wrote in message
news:uL****************@TK2MSFTNGP03.phx.gbl...

Andrew,

you can use IIS security setting to set only allowed IP addresses to
access the web application (service).
SSL will require you to buy client certificates for each client which may
be not the best solution.

Regards,

--
Martin Kulov
http://www.codeattest.com/blogs/martin

MVP, MCT, MCSD, MCPD

[Martin Kulov [MVP]]

"Andrew V" <aa*@aaa.aaa> wrote in message
news:OV**************@TK2MSFTNGP04.phx.gbl...

Thanks for replying Martin.

I'm worry that allowing access by ip is not strong enough as a hacker can
spoof the ip. What's your assessment of that threat?

Well, I do not see how an Internet user can change its IP address and still
receive the response from server.

I am not a security expert but this article says so also [1].
"Misconceptions of IP Spoofing

While some of the attacks described above are a bit outdated, such as
session hijacking for host-based authentication services, IP spoofing is
still prevalent in network scanning and probes, as well as denial of service
floods. However, the technique does not allow for anonymous Internet access,
which is a common misconception for those unfamiliar with the practice. Any
sort of spoofing beyond simple floods is relatively advanced and used in
very specific instances such as evasion and connection hijacking. "

[1] http://www.securityfocus.com/infocus/1674
HTH,
Martin