Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Let us assume that I have a web service in an ASP.NET project.

If I turn off the WSDL documentation protocol, will other users be able to:

  1. add a service reference to the web service?
  2. discover the methods and parameters of the web service?

This is the code that I am using to turn off the web service protocol:

<webServices>
    <protocols>
        <remove name="Documentation"/> 
    </protocols>
</webServices>
share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

WSDL is an XML-based format which describes how one ought to talk to a given Web service. However, this is not the only incarnation of that syntax. The server itself knows the syntax (of course) but also the legitimate client.

If an attacker wants to know how to talk to your Web service, he just has to reverse-engineer the client code. The client code is deployed in various places, it is a file written on disks and backup tapes and distribution mediums, it is also in the head of several developers, and the protocol may be documented and printed, so the attacker can scan the trash bins at the development site to obtain the information about the syntax. The WSDL can only help the attacker, but it would be a mistake to believe that without the WSDL the attacker is severely impaired.

As @Rook says, letting your Web service publish the WSDL is convenient for tests; it is also good for interoperability developments. Since any sane security policy has to assume that it is public or almost public anyway, you may at well leave it public.

share|improve this answer
    
Thank you for your response Thomas :) –  Matthew Aug 16 '13 at 17:34
add comment

It is possible to keep the WSDL private, or keep it cached on the client. However, this is just (in)security though obscurity. WSDLs are useful for generating test cases against your web service, and you should test your own service before any major release.

share|improve this answer
    
Thank you for your response Rook :) –  Matthew Aug 16 '13 at 17:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.