Beginning here, I’ll not be discussing what web services are, WSDL, Disco Files etc, anyone can easily get tons of data on these, from internet.
I am more concerned here about the Security aspect of Webservices.
If you are interested in exploring all the aspects of ASP.Net service security, here is the link
Having said all this time, let’s start the real story.
SOAP: Simple Object Access Protocol (uses XML and HTTP)
The protocol contains SOAP packets that have following three components.
- SOAP Envelope: the container in which the actual data will be packaged.
- SOAP Header (Optional).
- SOAP Body (generally used for returning results)
A typical SOAP message looks like this
version="1.0" encoding="utf-8"?><soap: Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <Soap: Header> soap: Header> <Soap: Body> soap: Body>soap:Envelope>Steps to be followed:
1.Create a Custom SOAP Header
2.Tell Webservice method to use this header
3. Pass the Credentials to the Service proxy and invoke the methods
Create Custom SOAP Header:
Following are the steps needed to create the custom header
- Add using System.Web.Services.Protocols(in case it is still not added)
- Create a Class, deriving it from SoapHeader Class
- Create logic in the file
public class MyHeader : SoapHeader
{
//Add logic/code here
}
This is all that is required for creating a custom SOAP header.
Now let’s create a Service that’ll use this header .The Code itself is o documented that it conforms to the article.
using System;
using System.Collections;
using System.ComponentModel;
using System.Data;
using System.Linq;
using System.Web;
using System.Web.Services;
//Included for SOAPHeader
using System.Web.Services.Protocols;
using System.Xml.Linq;
using config = System.Configuration.ConfigurationManager;
namespace SoapWebServices
{
///
/// This is SOAP Header Based Service requiring Username and Password
///
[WebService(Namespace = "http://tempuri.org/")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
[ToolboxItem(false)]
[System.Web.Script.Services.ScriptService]
public class Service1 : System.Web.Services.WebService
{
//Create Refrence toCustomer SOAP Header
public MyHeader header;
[WebMethod]
//Tell the method to use custom header
[SoapHeader("header", Required = true, Direction = SoapHeaderDirection.InOut)]
public string Authenticate()
{
//Extract the information from SOAP Header and perform Authentication
if (string.Compare(header.UserName, config.AppSettings["uname"]) == 0) //enter into it only if uname matches the stored value
{
if (string.Compare(header.Password, config.AppSettings["pwd"]) == 0) { }
return "Log-in SuccessFul";
}
else return "Enter Valid CredentialsSupplied Credentials are InCorrect!!";
}
}
//Custom Soap Header
public class MyHeader : SoapHeader
{
public string UserName;
public string Password;
}
}
Let’s Create a Web App, Add reference to the service and call it as follows:
public partial class _Default : System.Web.UI.Page
{
//Create Proxy
localhost.Service1 proxy = new SoapServiceClient.localhost.Service1();
protected void Page_Load(object sender, EventArgs e)
{
//Check if the Custom SOAPHeader object is NULL
if (proxy.MyHeaderValue == null)
{
proxy.MyHeaderValue = new SoapServiceClient.localhost.MyHeader();
}
callService();
}
private void callService()
{
//PAss the Credetials to SOAPHeader
proxy.MyHeaderValue.UserName = "pradeep1";
proxy.MyHeaderValue.Password = "pa55w0rd";
//Call the Service Method
Response.Write(proxy.Authenticate());
}
}
This was a quick overview of implementing security in WebServices.
Hope this was Helpful.
Til Next Time…Happy Coding.
Comments
Post a Comment