Question

I have an AjaxControlToolkit DynamicPopulate control that is updated by calls to a WCF service. I know I can check the HttpContext in the service request to see if a user of the page (and thus, the control) is authenticated. However, I don’t want anyone clever to be able to call the service directly, even if they’re logged in. I want access to the service to be allowed ONLY to requests that are made from the page. Mainly, I don’t want anyone to be able to programatically make a large number of calls and then reverse-engineer the algorithm that sits behind the service.

Any clever ideas on how this can be done? Maybe I’m over-thinking this?

Thanks in advance.

Answer 1

I solved this with a different approach. Instead of trying to secure the service to a single page, I just secured the service by checking HttpContext to make sure the user making the request is authenticated. This relies on ASP.NET Compatibility being enabled on the WCF service class: http://msdn.microsoft.com/en-us/library/ms752234.aspx

Then I have access to HttpContext within the service and can check that the call came from an authenticated user. =D