如何在 asp.net/Jquery 中保护 WebMethod

Question

I am using Jquery Ajax to call a WebMethod from aspx page.Here is my code

$(document).ready(function () {
        $("#btnshow").click(function () {
               $.ajax({

                type: "POST",
                url: "example.aspx/showData",
                data: "{}",
                contentType: "application/json; charset=utf-8",
                dataType: "json",
                success: function (msg) {
                    $("#Result").text(msg.d);
                }
            });
        });
    });

code on aspx.cs page:

[System.Web.Services.WebMethod()]
[System.Web.Script.Services.ScriptMethod()]
public static List<LandmarkList> showData()
{
    LandmarkList ObjLL = new LandmarkList();
    return ObjLL.GetDataList();
}

My question is what is a professional way to secure this web method?what are possible methods of securing webmethods so that a user wont copy that url from client debugging tools and use it.

Note:These are open pages,user do nto need to be loged in for these pages.

UPDATE: I want to make it more difficult for someone to continue using my webservice without actually visiting my site.

Answer 1

There is no showData() function in your code but yes anyone could simply call the example.aspx/showData url and get a response.

You can do stuff to try and ensure they are calling from your page. At it's simplest you could simply check they already have loaded the page via checking (in your web service) for a session parameter (which you set when the page loads). Or, for example, see http://www.asp.net/web-api/overview/security/preventing-cross-site-request-forgery-%28csrf%29-attacks .

However, without any form of authentication before loading the page and allowing the service call there I think that the value of any such security measures are dubious - you are giving yourself the illusion of security without actually having any. Anyone who wants to call your service can simply script a load of the page followed by the call and monitor your results. The web service is as open as the page calling it - and it's not meaningful to say "I've got this open web page but want to make sure it's only called in a certain way/by certain people".

You are safer, in my opinion, to simply treat the web service as open and not reveal anything there that you would not be comfortable putting on an open web page.

Answer 2

May not be the best solution in the world, but very easy and quick to implement-

Use Cloudflare > Firewall > Tools > Rate limiting > create custom rule to block visits more than a given frequency to differentiate between use and abuse