ASP.NET的WebService拒绝远程访问 [英] ASP.NET WebService deny remote access

问题描述

我创建了一个ASP.NET的WebService，对于使用ASP.NET AJAX被消耗掉。 web服务位于同一个盒子和相同的Web应用程序，它通过使用，所以我不想让这个Web服务进行远程访问，但它只能从本地主机的请求。

I've created an ASP.NET WebService that is to be consumed using ASP.NET Ajax. The WebService is located on the same box and same web application that it is to be used by, so I do not want to allow remote access to this webservice, but have it only respond to requests from localhost.

在web.config不具有配置部分并therfore没有httpPost和HTTPGET开启。这可以。但是，如果我直接从远程计算机浏览到WebService的URL，它仍然加载和显示我的方法的列表。点击该方法不会给我一个消息，说明该测试形式是不提供给远程计算机（如预期），但它确实对如何发出SOAP请求，并处理SOAP响应列表信息。

The Web.Config DOES NOT have a configuration section and therfore does not have httpPost and httpGet turned on. This is fine. However, if I navigate directly to the WebService URL from a remote machine, it still loads and shows me a list of methods. Clicking on the method does give me a message stating that the testing form is not available to remote machines (as intended), but it does list information on how to issue a Soap Request and handle a Soap Response.

此外，我相信我正在通过某种只是一个好奇的用户的僵尸刮掉，因为我现在收到错误消息，在我的日志像这样...

Additionally, I believe I'm being scraped by a bot of some sort of just a curious user, because I'm now getting error message in my log such as this...

System.InvalidOperationException: Request format is unrecognized for URL
unexpectedly ending in '/ValidateUsername'.

这会发生，如果你尝试发出GET请求（通过操作查询字符串）对远程服务。我很高兴，它不处理请求，因为我不希望远程用户访问这个服务做的，但我会preFER它不会引发错误。

This happens if you try to issue a GET request (by manipulating the query string) against the service remotely. I'm glad that it's not handling the request as I don't want remote users access to this service, but I would prefer it not throw an error.

如何可以锁定web服务，使其无法使用远程机器，但仍然可以在本地计算机作为consumably通过ASP.NET AJAX？

How can I lock down the webservice so that it is not available to remote machine, but still available to the local machine as a ScriptService consumably by ASP.NET Ajax?

更新：
好了，这是发生了什么可行的例子。

UPDATE: Okay, here is workable example of what is happening.

网站： http://so.weirdwes.dyndns.org/default.aspx

WebService的： http://so.weirdwes.dyndns.org/services/services。 ASMX

WebService: http://so.weirdwes.dyndns.org/services/services.asmx

Web.Config中：

Web.Config:

<webServices>
  <protocols>
    <remove name="HttpGet"/>
    <remove name="HttpPost"/>
  </protocols>
</webServices>

该网站使用消耗一个ScriptManager标记和的ScriptReference WebService的。你会注意到，如果你点击该按钮，调用Web服务，一切工作，即使POST和GET已被删除。这是罚款，这是我们希望它的工作。问题是这样的....
http://so.weirdwes.dyndns.org/services/services.asmx/GetRemoteAddr

Server Error in '/' Application.
--------------------------------------------------------------------------------

Request format is unrecognized for URL unexpectedly ending in '/GetRemoteAddr'.

一个僵尸或东西刮这个URL，它的产生，我们正在得到通知的错误。我想苏preSS这个错误或者完全阻止它。如果我改变的Web.Config并添加Get和邮政协议回来，这个错误消失 - 但随后允许访问Web服务使用远程获取这是我们不希望

A bot or something is scraping this URL and it's generating errors that we're get notified of. I want to supress this error or block it entirely. If I alter the Web.Config and add the Get and Post protocols back in, this error goes away - but then it allows access to the web service remotely using Get which we don't want.

推荐答案

我有点困惑在这里。

这种的被浏览器叫什么名字？这是否是，那么你就应该允许远程访问。

Is this going to be called by the browser? if it will be, then you should allow remote access.

这篇关于ASP.NET的WebService拒绝远程访问的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！