Block cross domain calls to asp.net .asmx web service

Question

I've built an application that uses jQuery and JSON to consume an ASP.NET .asmx web service to perform crud operations. The application and .asmx are on the same domain. I dont mind people consuming the read operations of the .asmx remotely but dont want people randomly deleting stuff!!!

I can split the methods i'd like to be publicly accessible and the 'hidden' ones into 2 web services. How can I lock calls to the 'hidden'.asmx web service to the same domain that its hosted in?

Thanks in advance.

Edit: Can someone comment on this, seems plausible ( source: http://www.slideshare.net/simon/web-security-horror-stories-presentation ): Ajax can set Http headers, normal forms cant. Ajax requests must be from the same domain.

So "x-requested-with" "XMLHttpRequest" requests must be from the same domain.

Answer 1

There are two scenarios you need to secure with web services:

1. Is the user authenticated?
2. Is the action coming from my page?

The authentication piece is already taken care of if you're using Forms Authentication. If your web service sits in a Forms Authentication-protected area of the site, nobody will be able to access your web services unless they're logged in.

The second scenario is a slightly trickier story. The attack is known as CSRF or XSRF (Cross Site Request Forgery). This means that a malicious website performs actions on behalf of your user while they're still logged in to your site. Here's a great writeup on XSRF.

Jeff Atwood sort of sums it all up in the link above, but here is XSRF protection in four steps:

1. Write a GUID to your user's cookie.
2. Before your AJAX call, read this value out of the cookie and add it to the web service POST.
3. On the server side, compare the FORM value with the cookie value.
4. Because sites cannot read cookies from another domain, you're safe.

Answer 2

In AJAX the browser makes the calls, so even if you were to check that the domain is the same it wouldnt be secure enough because it can easily be faked.

You need to use some sort of authetication/autharization tokens (preferably with a time out) to keep things safe.

Answer 3

Quick and dirty solution would be to use IP address restrictions to allow only your domain's IP address access via IIS.

Probably better would be using HTTP authentication. There are many ways to do this, I found Authentication in ASP.NET Web Services a helpful overview.