0

I am working on a site that exposes a set of webservices within a folder in the site:

services
--- servicea.asmx
--- serviceb.asmx

These services are set up to allow some interoperability with other sites that we control, and these all reside on the same server.

The site uses asp.net forms based authentication, but the services folder has been exempted from this and each service performs it's own authentication when calling a method, and checks that he access is from a local address only, and this works fine.

However, if I access services/servicea.asmx from an external address, I can still see a list of the methods available. I cannot effectively call any of these methods from an external address, which is as it should be, but I'm not comfortable exposing our internal API like this. Is there any way to stop an asmx file from responding with a list of methods when accessed outside the box?

Paddy
  • 33,309
  • 15
  • 79
  • 114

1 Answers1

1

You should be able to add the following to your web.config:

<system.web.services>
    <protocols>
        <remove name="Documentation"/>
    </protocols>
</system.web.services>

This should hide the service description page.

See http://msdn.microsoft.com/en-us/library/b2c0ew36%28v=vs.100%29.aspx for more information - note that this also prevents the client from generating a WSDL proxy class, so it can be a real barrier to ease of implementation.

Hiding the method names is no substitute for security though so you might want to consider if you need to do this or not.

dash
  • 89,546
  • 4
  • 51
  • 71
  • Do you know if there is a way to do this on a per service level - we have some other items that should be externally accessible. – Paddy Mar 16 '12 at 10:56
  • One idea is to try using the location element: http://msdn.microsoft.com/en-us/library/b6x6shw7%28v=vs.100%29.aspx - you could try nesting the block above in a element for example but I couldn't find any reference in the docs to say this would work - sorry. Otherwise, you'd have to put each one in it's own virtual directory or similar so they are effectively isolated from each other. – dash Mar 16 '12 at 11:41