Security on a WCF public web service

Question

I'm building a complex, public web service in WCF that send email to a specific address, similar to a contact form but with some features. With jQuery I get the data from the textbox and with Ajax and json I send to the web service the strings to proceed at the send.

Now, is there a good way to make it secure?

I mean.. the service is public so someone can have access to it and starting to spam on this address. Can I restrict the users to use the web service only from the correct web site?

Thanks.

Answer 1

如果WCF服务托管在IIS中，您只允许来自特定IP地址的呼叫，请查看IIS下的目录安全设置。

Answer 2

By far the simplest way is to have your web service require some type of access key in order to run the operation.

Something simple like a base64 encoded GUID would work. It doesn't even have to change. Just add a parameter called "AccessKey" or something similar. Have your app pass that and let the service validate that it is good.

Another idea is to have the web service check the http headers to see if it came from the page you authorized to use it.

---

Neither of those are perfect. The first one means that your "key" will be inside the html you send to the client. The second one can be spoofed.

Personally, I'd probably not bother at this level and just log what the service is doing. If the traffic counts to the service start to exceed what you think it ought to be, then I'd investigate ways to mitigate it. Most likely, given that it's a service you won't see any issues.