Is WCF Service EntitySetRights.AllRead Secure?

Question

I have the following code inside MyDataService.svc.cs (This is an example from DevExpress):

namespace MyDataService {

    [System.ServiceModel.ServiceBehavior(IncludeExceptionDetailInFaults = true)]

    [JSONPSupportBehavior]
    public class DataService : DataService<TestDataEntities>, IServiceProvider {
        public static void InitializeService(DataServiceConfiguration config) {
            config.SetEntitySetAccessRule("*", EntitySetRights.AllRead);
            config.DataServiceBehavior.MaxProtocolVersion = DataServiceProtocolVersion.V3;
        }

        public object GetService(Type serviceType) {
            if (serviceType == typeof(IDataServiceStreamProvider)) {
                return new ImageStreamProvider();
            }
            return null;
        }

        protected override void OnStartProcessingRequest(ProcessRequestArgs args) {
            CustomBasicAuth.Authenticate(HttpContext.Current);
            if (HttpContext.Current.User == null)
                throw new DataServiceException(401, "Invalid login or password");
            base.OnStartProcessingRequest(args);
        }
    }
}

So while this is will check the Entity for a username and password, how safe is it that config.SetEntitySetAccessRule is set to AllRead. Wouldn't someone just be able to see this information on a url such as www.website.com/MyDataService.svc/Customer (where Customer is the table). If this is not so can someone please fill in the conceptual gap I am facing. Thanks!

Answer 1

You are correct that all entities will be returned when queried - AllRead just disallows insert updates and deletes.

You will need to use Query Interceptor to add your logic to restrict users to the set of data they have permission to view, for example adding a check user id to the query.