WCF / ASMX :: How To Secure A WCF Web Service / Using Traditional "connection String In Web.configâ€
Aug 2, 2010
How do you secure a WCF web service when you are using the traditional "connection string in the web.config"?
I have added a WCF service to an application which uses a JQuery post and returns JSON. The request happens on the client side. The purpose of this service is to return search information while the person is typing text into a textbox.
It works well, but there is a problem because the application will be used by a number of people and I am maintaining a role based security within the applications MS SQL database. The connection string to the database is in the web.config file.
In order to run the JQuery call to the web service the user must have at least read access directly to the database. I want to allow the application to control the access, but removing all security to the WCF service opens the application up for external access by unauthorized users.
View 3 Replies
Similar Messages:
Jul 20, 2010
I am developing web service for my windows mobile application..! But the new requirement is the web service must be an secure..! for example : My web service name is [URL] Instead of that , client wants to [URL] How I create https web service..! I am using visual studio 2008. windows 7
View 1 Replies
Oct 16, 2010
I need advice on how to secure my WCF web service hosted in IIS. I am new to WCF and would appreciate any sample code, articles to help me restrict access to my WCF service.
I am in the process of testing and deploying a WCF service that will be available on the internet. I need to secure the web service so that only authorized clients can use the service. I need to be able to detect who the client is making the call to the service. The group I am building this service for wants to use Certificate authentication or IP address to Identify the themselves to call my web service. They do not want to use user name and password.
I have found several articles and code snippets for getting the IP address of the client and Certificate authentication. The problem I found using trying to get the IP address of the client is that since my web service his hosted behind a F5 or some type of reverse proxy I cannot get the true IP of the client. The IP that the web services get is the IP of the F5 or the reverse proxy.
For Certificate Authentication I followed the directions from the 9 simple steps to enable X.509 certificates on WCF located here
http://www.codeproject.com/KB/WCF/9StepsWCF.aspx?msg=3181718. I had a few problems using this setup for my web service. 1) To me it seemed like as long as the user presented a valid Certificate they would be able to call my web service.
2) Does Certificate Authentication work when the security mode is set to Transport? In my production environment only HTTPS traffic is allowed through. I setup a Certificate authention on my service following the steps outlined in the article. I used the SSL certificate assigned to my server for the web services. For the client outside the network the service is hosted on, I used one of the certificates I generated when i tested the code locally. I changed the authentication mode of the certificate to chain trust for both the client and the server. I was able to call the service and recieve a message. I thought that since my certificate was self generated using the makecert command that the web services would not authenticate the client for the service.
how I can secure my services to only allow a few approved clients to call call the service.
View 17 Replies
Dec 30, 2010
How to secure the connection string in the webconfig the best way
View 1 Replies
Oct 27, 2010
I have a web service that calls another web service (not my design).The wrapper web service is our code the underlying web service is 3rd party.The issue is that when one of our apps calls the web service wrapper.. it opens a new connection to the underlying web service and that login time is around 10seconds! (3rd party issue)... the calls after the login are fast in testing.SO we are trying to have ONE login for all the calls to the underlying services. However our wrapper service is called one by one..I was thinking if there was a way to store the underlying web service connection in a cache (netbean?) I could reuse it for all web service connections to the 3rd party...
View 1 Replies
Apr 30, 2010
I receive the following error, when trying to consume Wcf service:
"An existing connection was forcibly closed by the remote host". Consuming the service works fine when the host and the client are on the same machine. When I move the client to Hyper-V virtual machine (I didn't try it on a real computer) - it throws the error. Both firewalls are turned off Do you know what can cause such behaviour? Here are the details:
Both the client (hyper-v) and the service are on Windows server 2008 R2
Service url - http://wcftest/CalculatorService.svc (wcftest is the website and is mapped in the hosts file to localhost)
Service config:
[Code]....
Client config:
[Code]....
Are there any configuration settings which I'm missing?
View 1 Replies
Feb 26, 2011
I have a WCF service which has 4 Operation contracts.
I have added a new contract and it gets the data from database and returns the result set.
I can access the new contract and the service get the correct result set. But while passing the result set to the client I get the error of The underlying connection was closed: The connection was closed unexpectedly.
What are the steps to follow after adding a new contract like new binding etc.
View 3 Replies
Nov 5, 2010
Using vb.net/vs.net 2005
I am writing a windows service but normally I write only asp.net apps. In asp.net app I store my connection strings in a web.config file, what is the correct place to store connection strings in a windows service?
View 2 Replies
Jul 30, 2010
I need a connection string to connect the microsoft 2003 database with my ASP.NET webserviceWhen just making a website I used to use the following connection statement
OleDbConnection dbconn = new OleDbConnection("Provider=Microsoft.Jet.OLEDB.4.0; data source=" + + Server.MapPath("~/db/SalesCentral.mdb"));
Now as I am using a webservice the Server.MapPath function is giving an error
View 4 Replies
Feb 14, 2011
I have a web service that is declared like this.
[Code]....
Function inside the service simply returns string separated by some delimitor. This string is then used by JS function to assign to a jQuery datatable. Is there a maximum limit on size of this string? I have about 2000 rows with 6 columns each. I get an error (failed handle) when I return them all. But if I do only top 500, it works fine.Is there any size limitation?
[WebService(Namespace = "http://tempuri.org/")]
View 8 Replies
Feb 6, 2011
I have number of files stored in a folder.
I want to write a wcf service to ruturn a list of filenames based on the text typed in a text box.
The structure of the method i need is something like this :
[Code]....
The requirments is to return only the filenames that starts with the typed text. Only the file name part is required not the full path.
View 3 Replies
Feb 2, 2011
I have a db connection string 'ApplicationServices' defined in the connectionString section of web.config and 3 Entity Framework connection strings which have the provider connection string attribute with the same connection string as the one in 'ApplicationServices'. Is there a way to reference connectionString in 'ApplicationServices' for the provider connection string attribute of the EF connection string in the web.config, rather than providing the connection string all over again?
View 1 Replies
May 28, 2010
How can I force page to use secure connection "https". Client might call the page using insecure connection. I want the page to to check connection, if insecure connection "http" is being used, reload the page with secure "https" connection
View 8 Replies
Jan 25, 2010
How to make web services secure in asp.net both the asmx and on WCF. Currently we have web services and now are in process of converting them to WCF in some modules in our application. Now as upgradation is in process we like to incorporate security on the web services as we intend to open some of them to all our clients via web (they contain both asmx and WCF as well).
View 1 Replies
May 7, 2015
I have written the above code and im getting an error as below-System.Net.Mail.SmtpException: The SMTP server requires a secure connection or the client was not authenticated. The server response was: 5.5.1 Authentication Required. Learn more at at
System.Net.Mail.MailCommand.CheckResponse(SmtpStatusCode statusCode, String response) at System.Net.Mail.MailCommand.Send(SmtpConnection conn, Byte[] command, MailAddress from, Boolean allowUnicode) at System.Net.Mail.SmtpTransport.SendMail(MailAddress sender, MailAddressCollection recipients, String deliveryNotify, Boolean allowUnicode, SmtpFailedRecipientException& exception) at System.Net.Mail.SmtpClient.Send(MailMessage message) at smtptest._Default.btnSend_Click(Object sender, EventArgs e) in c:usersadministratordocumentsvisual studio 2010ProjectssmtptestsmtptestDefault.aspx.cs:line 71
Its working on local but when im hosting my application im getting above error
using (MailMessage mm = new MailMessage("myid@gmail.com","reciverid@yahoo.com"))
{
mm.Subject = "test";
mm.Body = "email testing";
mm.IsBodyHtml = false;
SmtpClient smtp = new SmtpClient();
[code]....
View 1 Replies
Sep 6, 2010
IIS 6 installed on Vista (Virtual PC) not member of domain, Visual studio 2008 based website. Active Directory Membership configured in web.config.
Trust level set to Full. Using Login control to authenticate.
[Code]....
View 2 Replies
Oct 25, 2010
In IIS7 I don't find any possibility to keep a website from responding to it's IP address as soon there is SSL set up for this website. I did not add the IP address as hostname for this website and so would expect that the site does only respond to it's given hostname(s). Unfortunately the website won't work if requested via it's IP address, so I have to disable IP address as hostname somehow.
Another issue is that IIS 7 does not display the "secure connection obligatory" error page anymore if secure connection is mandatory for a website. Is there any way to get this error page being displayed, just like it was in IIS6 ?
View 3 Replies
Nov 3, 2010
I cannot get a successful connectiong to the active directory when logging onto a web form. Here is the code I have in the web.config:
<configuration>
<appSettings/>
<connectionStrings>
[code]...
View 1 Replies
Oct 11, 2012
I am created a from sending mails. I have tried ur code.. But I am getting under error.
The SMTP server requires a secure connection or the client was not authenticated. The server response was: 5.5.1 Authentication RequiredÂ
View 1 Replies
Mar 15, 2011
just for my testing purpose i know i can define both the connection's outside in a single web config file by different name's and access them in my front end according to it but what if i want to have seprate for both connection's web.config situation is like this see image so i want to access my connections from second web config file how i can do that.
[Code]...
i tired this but its giving error
[Code]....
View 1 Replies
Jul 23, 2010
We're having an error similar to the one detailed here. We get the error noted above when trying to do AD authentication from our .net (3.5) mvc 2 app. This is our first .net mvc app ...
http://forums.asp.net/t/1161047.aspx
- We are re-using a forms auth library written for a .Net 2 app
- that library/app/config used a service account with min. privileges for binding to AD
- This error occurs in VS 2008, have not tried deploying the app to a server yet (a little early for that)
- like the other user at the previously referenced thread, I can get the 'unable to establish ...' error to go away and display the log on page by putting *MY* credentials in instead of the service account (but not successfully authenticate)
- moving the service account into the same AD OU as my account does not seem to change it ... only using my account credentials does.
- trust level is set to full
Is this some odd permissions trick that is new with .Net 3.5 (even though the ADmembershipProvider is still a 2.0 libary)? This should have nothing to do with MVC itself.
Config looks like this (very standard, like every one else's)
[Code]....
The line/portion highlighted in the debug/stacktrace is:
type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
View 2 Replies
Jul 4, 2013
In my application there are 4 connection strings...from that i want one connectionstring should be default connection string.How to do ?
View 1 Replies
Sep 23, 2010
When a web service is consumed from server side, the web service may be implemented in a way to check credentials of the caller. In the case of calling the web service from javascript, how to secure the service since no credentials can be passed into a javascript function becuase of the visibility in source view?
View 7 Replies
Jul 2, 2010
I have a webservice that's behind form's authentication. The site that hosts the service also serves as a site that requires a user to log in via the login page.I have a second site that needs to be able to access the service that the first site hosts. However, when attempting to access the service, it fails because the service requires that the user is logged in.
View 1 Replies
Jan 18, 2011
In my web site i'm using Asp.net web service (using javascript) to update certain values to DB. I'm concered about the security threats. How can i secure ASP.net Ajax web service using javascript
View 6 Replies
