限制对ASMX Web服务的访问

Question

I have a single ASMX web service that has a host of methods that can be called. However, I'm wanting to restrict certain methods so that the caller either needs to be authenticated in order to be able to call them, or even better can only be called from the local server in which the service is running from.

Basically those methods needing to be protected will be called by the Microsoft Windows Scheduler on the local server.

Is either option possible, and what is the best and preferred way of achieving this.

Answer 1

At the top of the web services you want to protect, you can do something like:

if (!Request.IsLocal)
{
    Response.StatusCode = 401;
    Response.StatusDescription = "Unauthorized";
    return null;
}

You could also check if they are authenticated with the IsAuthenticated property.

Answer 2

Of the two methods you mention, by far the easiest is to restrict access to just the local server. You can do this through code (as another comment has noted), or by administration of IIS itself.

If you load up the IIS Manager and select the folder that your asmx file is in, you'll see on the right-hand side a section 'IP Address and Domain Restrictions'. Open this up, add a default deny rule, and then an allow rule for 127.0.0.1.

Be aware that using this method will restrict all services in this folder, so you may need to move this into its own folder if this isn't required or desirable.