[2005] Web Service Security options

[kleinma]

I have worked with webservices a bit in 2003, and I just upgraded a 2003 WS project to 2005.

I am just wondering if there are any new security considerations I can use to make this WS as secure as possible.

I will refer to my programs as winapp (for the windows app that consumes the service, and SecureWS as the web service to be consumed)

My ultimate goal is this:
Only authenticated callers (aka winapp) can access the methods of the webservice.

What I have implemented so far:
-All calls to SecureWS are over SSL
-My webhost allows me to create user accounts so I can deny anonymous access to the directory where SecureWS sits, but allow access from an account I create. So I create a user acct that only has access to that SecureWS. This is so you can't nagivate to the URL of my ASMX file and see all the methods.
-I have a TripleDES encrypted string of the credentials (credentials for the user account I created on my web host) stored in winapp, and at runtime when I call the SecureWS, i decrypt it, and pass it as credentials to SecureWS


Is there anything I am over doing, missing, doing wrong?

I have found some articles on WS security, however they mostly deal with situations where you have full access to IIS, which I do not.

However I do want to protect my service from unauthorized access, or from brute force attacks. I am not some big software company, so I may be overdoing it a little on security, as I don't expect a ton of people trying to hack this, however it does only take one person, not a ton.

[wild_bill]

IIRC you can use the web.config file to prevent anyone from browing to your page and exposing the methods. I'm at home now, but I'll check my service tomorrow for the code. For authentication I used microsoft's WSE2 toolkit. It works nice, as it allows me to store usernames, and hashed passwords in our mssql db. I can get you example code of that as well if you want it.

[wild_bill]

Here are the config settings to allow human interface with the service, handy for testing.

    <webServices>
        <protocols>
            <add name="HttpGet"/>
            <add name="HttpPost"/>
        </protocols>
    </webServices>

If you remove these tags, a program is required to run the methods.
Here is some sample code for my client that consumes a web service that uses WSE 2.0.

'''Install WSE 2.0 from [url]http://www.microsoft.com/downloads/details.aspx?FamilyId=FC5F06C5-821F-41D3-A4FE-6C7B56423841&displaylang=en[/url]
'''Right click project, go to WSE Settings, ensure top checkbox is checked under the general tab
'''Add web reference, make sure to use web service instance that is followed by Wse.
'''Example: myWsRef.ClassNameWse not myWsRef.ClassName
    Private Sub btnConnect_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnConnect.Click
        Me.Cursor = Cursors.WaitCursor
        btnConnect.Enabled = False
        'Create a UsernameToken instance
        Dim ut As New Security.Tokens.UsernameToken(txtUsername.Text, txtPassword.Text, Security.Tokens.PasswordOption.SendPlainText)
        'Create a new instance of the web service
        Dim ws As New hewWs.UserInterfaceWse
 
        Try
            'Add the token to the Tokens collection
            ws.RequestSoapContext.Security.Tokens.Add(ut)
            'call ws
            If ws.UpdatePassword(txtNewPassword.Text) Then
                txtMessage.Text = "Success!"
            End If
        Catch exSoap As System.Web.Services.Protocols.SoapHeaderException
            'There was an authentication problem
            txtMessage.Text = exSoap.Message
        Catch ex As Exception
            'There was some other kind of exception
            txtMessage.Text = ex.Message
        Finally
            ws = Nothing
            Me.Cursor = Cursors.Default
            btnConnect.Enabled = True
        End Try
 
    End Sub

And a sweet tutorial I used for useing WSE: http://aspnet.4guysfromrolla.com/articles/071404-1.aspx

[kleinma]

Thanks Bill,
I am sorting out the obfuscation and cleaning up the windows app that consumes the service, so as soon as I am done with that I will look to implement this and let you know how it goes.

[kleinma]

bill, those protocols are not in the web.config by default

<webServices>
        <protocols>
          <add name="HttpGet"/>
          <add name="HttpPost"/>
        </protocols>
      </webServices>

are you saying that they SHOULD be there by default, and I can remove them to disallow browser level access to the methods?

[wild_bill]

I beleive it is disallowed by default, just for security purposes. I have to add them to my dev sites for debugging purposes.

[kleinma]

you mean you debug your web services in the browser? I usually just debug them in Visual Studio. Do you gain something by debugging them in the browser?

[wild_bill]

If I'm making alot of changes, it's nice to be able to make a quick change, browse to my service and test it. It's also pretty slick at displaying the output. Also, I should specify that I can't debug all my web service methods on my developement machine, because of third party software.