Question

A brwoser will do a SOAP request to a server and I want to ensure that the request is coming from a HTML page that is rendered before.

The javascript code looks as follow:

var url = 'http://www....nl/getmedata.asmx?op=fake';
var soapRequest = '<?xml .... >'; // The SOAP message
$.ajax({
    type: "POST",
    url: url,
    contentType: "text/xml",
    dataType: "xml",
    data: soapRequest,
    success: processSuccess,
    error: processError
}); 

Everyone can read this code and can abuse the webservices. I like to know, is it possible to prevent this and ensure that the SOAP request is coming from the page that the server has rendered?

Maybe somethings with CryptoServiceProvider but how to do this in Javascript?

Answer 1

You can generate a token while rendering the webpage & add that in the SOAP request to make sure that SOAP request can only be considered valid if user has a valid token.