我能够将用户名和密码传递给Web服务，但这不是我需要防止未经授权的用户访问的方式

Question

This is another question I have about web services and securing them. I made a WCF Web Service and this is the code that I used...

    [OperationContract]
    [WebInvoke(Method = "GET")]
    string myData(string name, string pass);

and this is the code that I use to interact with the web service...

    public string myData(string a, string b)
    {
        if (a == "chris" && b == "pass")
            return "You did it";
        else
            return "Nope";
    }

I know this looks basic and I understand that I can add more functionality to it, but I don't think this is the way I need. It looks a little dirty to me.

If have a web service sitting on a server and if someone tries to use the service, I would like a pop up to ask for a username and password, so I can verify that they are in the database and they can proceed invoking the web service.

For this to be done, should I set up authentication in IIS to do this? I think I'm over thinking things. My client just wants me to be able to secure the web service from unauthorized users. So That's what I am running into an issue with, I'm not sure the correct way to secure everything from unauthorized access, should (and how) this be done in IIS or just use the code that I provided.

I apologize if this kind of question has been asked a million times but the question is always different and so are the answers.

Answer 1

You should set your authentication method say forms authentication and set you credential in request. Also better do it as HTTPS.