Microsoft ASMX Web Services Test form available on remote machines

Question

I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized that, from my machine, I was able to use the Test form to consume the service,a part from that I was able to see the HTTP mechanism to send SOAP over HTTP. Making this information available to remote users could drive to unwanted invocations and it could also drive to DoS attacks.

Do you believe that showing this Test form to remote users could drive to a service attack?

Answer 1

When releasing a ASMX/WCF/SOAP webservice to production it's recommended to disable metadata access and turn off the test entry form. Yes, you should disable the test form for ASMX, and better yet, you should upgrade the ASMX to a WCF endpoint.

Will leaving it on lead to DoS attacks? No, probably not. Will someone try and enter in data if they come across it? Yeah. Where the problem lies though is the WSDL metadata. With the WSDL you can consume the web service from another application and call the service directly without having to go through the test form. If you turn off metadata, you can't get to the WSDL, so only clients that you trust should know about the interfaces for the service.

Answer 2

There are couple approaches here, first and the most dilettantish way is to modify the page where the information is shown: Page DefaultWsdlHelperGenerator.aspx located in %SYSTEMROOT%\microsoft.net\framework\v1.1.4322\Config

More advanced way is to do this in Web.config of your web site:

<webServices>
<protocols>
              <remove name="Documentation"/>
</protocols>
</webServices>

Also you can implement your HttpModule and customize the way of your webservice consumption.