While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF.
There isn't a lot of good information out there and it seems that in .NET, *.asmx are protected by default to CSRF, with a possible exception of an exploit scenario using Flash (to set the cookies)
If you want to take a look at the code, the whole thing is at GitHub, and here is the source code of the version with a test Library (OWASP Top 10): https://github.com/TeamMentor-OWASP/Master (just download the zip file and click on the 'Start webserver.bat' to have a locally running copy)
If you just want to take a look at it, check out this test server: http://220.127.116.11:8081 for the main GUI and http://18.104.22.168:8081/aspx_pages/tm_webservices.asmx for the webservices In terms of CSRF for ASMX, my current understanding comes mainly from this Scott Guthrie article http://weblogs.asp.net/scottgu/archive/2007/04/04/json-hijacking-and-how-asp-net-ajax-1-0-mitigates-these-attacks.aspx (also referenced here AJAX Hacker Attacks - Cross Site Request Forgery )
Those articles imply that asmx webservices are not vulnerable to CSRF due to the extra application/json ContentType header.