How do I restrict the WCF service called by an ASP.NET AJAX

I have an AjaxControlToolkit DynamicPopulate control that is updated by calls to a WCF service. I know I can check the HttpContext in the service request to see if a user of the page (and thus, the control) is authenticated. However, I don’t want anyone clever to be able to call the service directly, even if they’re logged …

via Asp.Net Developed Tutorials » Search Results » ajax:

How do I restrict the WCF service called by an ASP.NET AJAX

I have an AjaxControlToolkit DynamicPopulate control that is updated by calls to a WCF service. I know I can check the HttpContext in the service request to see if a user of the page (and thus, the control) is authenticated. However, I don’t want anyone clever to be able to call the service directly, even if they’re logged in. I want access to the service to be allowed ONLY to requests that are made from the page. Mainly, I don’t want anyone to be able to programatically make a large number of calls and then reverse-engineer the algorithm that sits behind the service.
Any clever ideas on how this can be done? Maybe I’m over-thinking this?
Thanks in advance.
…………………………………….

The simple answer is you can’t. The complicated answer is you can fudge it with a lot of work, you could for example
Rate limit based on the IP of the caller.
Drop a cookie based upon the session and rate limit on that.
Drop a cookie based upon the page when the page loads and rate limit upon that.
However none is foolproof, and all can go wrong with legitimate requests.
…………………………………….

If you really want to restrict this to just this one server making the request, you could add a certificate to that server and check for that certificate. However, you probably can’t really limit access to just a single page calling your service.
You could add a lot of additional elements, like headers etc. – but none will really be totally sound – if someone is determined enough, they’ll be able to figure out what you’re doing, and replicate that.
So really: why do you need to limit this access this badly?
…………………………………….

I solved this with a different approach. Instead of trying to secure the service to a single page, I just secured the service by checking HttpContext to make sure the user making the request is authenticated. This relies on ASP.NET Compatibility being enabled on the WCF service class: http://msdn.microsoft.com/en-us/library/ms752234.aspx
Then I have access to HttpContext within the service and can check that the call came from an authenticated user. =D

For more info: How do I restrict the WCF service called by an ASP.NET AJAX

Asp.Net Developed Tutorials » Search Results » ajax

How do I restrict the WCF service called by an ASP.NET AJAX

Share this post:

Related Posts

Leave a Comment