.NET AJAX Enabled WCF Service called from a different website

Question

I have an AJAX-Enabled WCF service on website aaa.com and call this service clientside using code like this:

mySVC.MakeBooking(somedata, onSucccess, onFailed, null);

which works perfectly for me. My question is, can someone from malicious website bbb.com make this call to my server or is the service domain specific?

Answer 1

yes any one can call this service, becuase WCF supports certificates based security, else you can do implement some type of security by you self, like passing some userid or key to identify a valid calling. so that if others are calling same will not be returned any data.