We have an asmx web service hosted in IIS6. Is there a good way to limit the number of calls to the service in a period of time for a single IP? We don’t want to put a hard limit (X number of times an hour), but we want to be able to prevent a spike from a single user.
We’re currently investigating to see if our firewall is capable of limiting connection attempts. In the case that our firewall is not able to limit connections, is there a good way to handle this programmatically? Rather than trying to come up with our own custom solution and reinventing the wheel, is there an existing implementation or strategy that can be used?
ASMX web services have almost no extensibility. If you have any choice, you should use WCF.
You might be able to write a method to be called from each of your operations, that would look at the caller IP, check in a database, and throw a SoapFault if that IP has connected too much. That’s about all there is, though. You might be able to do that from a SoapExtension, but you have to be very careful with those.