How to limit access to a WCF service, by referer?

Question

I have a service that I access from jQuery on a page, it looks like this:

[ServiceContract(Namespace = "")]
[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)]
public class FacadeService
{
    ServiceHelper serviceHelper = new ServiceHelper();

    [OperationContract]
    [WebGet(ResponseFormat=WebMessageFormat.Json)]
    public String GetAllProducts()
    {
        Uri uri = new Uri("http://localhost:12345/api/Products");

        return serviceHelper.SubmitGetRequestToService(uri);
    }
}

That's great, but anyone can now open a browser and hit this service. I want only the local website to be able to access this service. Is there any built-in way to do this or must I devise some clever scheme to keep out the riff-raff?

Answer 1

If you are hosted your servin on IIS, probably the simplest way will be to limit service url access via IIS tools.

If you have do it with wcf service itself, you can add your behavior for ip filtering, see this and this posts for example.

But I still think it'll be easier to accomplish it via standard IIS tools.