I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized that, from my machine, I was able to use the Test form to consume the service,a part from that I was able to see the HTTP mechanism to send SOAP over HTTP. Making this information available to remote users could drive to unwanted invocations and it could also drive to DoS attacks.

Do you believe that showing this Test form to remote users could drive to a service attack?


When releasing a ASMX/WCF/SOAP webservice to production it's recommended to disable metadata access and turn off the test entry form. Yes, you should disable the test form for ASMX, and better yet, you should upgrade the ASMX to a WCF endpoint.

Will leaving it on lead to DoS attacks? No, probably not. Will someone try and enter in data if they come across it? Yeah. Where the problem lies though is the WSDL metadata. With the WSDL you can consume the web service from another application and call the service directly without having to go through the test form. If you turn off metadata, you can't get to the WSDL, so only clients that you trust should know about the interfaces for the service.

| improve this answer | |
  • Thanks Steve. I think It could lead to DoS attacks because metadata tells you the way to send SOAP envelopes over HTTP. So you could use tools like Fiddler2 to send heavy SOAP envelopes and heavy XML payloads. I just think that a production Services should not expose this kind of data. – Michael Hidalgo Jan 14 '12 at 3:18

There are couple approaches here, first and the most dilettantish way is to modify the page where the information is shown: Page DefaultWsdlHelperGenerator.aspx located in %SYSTEMROOT%\microsoft.net\framework\v1.1.4322\Config

More advanced way is to do this in Web.config of your web site:

              <remove name="Documentation"/>

Also you can implement your HttpModule and customize the way of your webservice consumption.

| improve this answer | |
  • Thanks that is very good recommendation. If you hide the Documentation using the remove tag, you also hide the WSDL file right? – Michael Hidalgo Jan 14 '12 at 3:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.