保护Webmethods

Question

I am using JQuery AJAX with webmethods . As regular session authentication wont work in webmethod what are possible methods of securing webmethods so that a user wont copy that url from client debugging tools and use it .

Answer 1

You can use sessions in your webmethods. Simply add (true) into your WebMethod attribute.

[WebMethod(true)]
public string MyMethod

If you're using some of the built in authentication you can also use:

[Authorize(Roles = "RoleName")]

Answer 2

If your WebMethod doesn't live on the same box as the rest of your app, you can also pass in some kind of salted and hashed timestamp or other information as one of the parameters in the call.

Logic inside the webmethod itself could then decode the hash and match it to a list of currently logged in users and IPs and/or read an expiration date so the url would be useless if copied and called elsewhere.

If the WebMethods are all part of the same application though, just depending on the Session is going to be your best bet.