Let us assume that I have a web service in an ASP.NET project.

If I turn off the WSDL documentation protocol, will other users be able to:

  1. add a service reference to the web service?
  2. discover the methods and parameters of the web service?

This is the code that I am using to turn off the web service protocol:

        <remove name="Documentation"/> 

2 Answers 2


WSDL is an XML-based format which describes how one ought to talk to a given Web service. However, this is not the only incarnation of that syntax. The server itself knows the syntax (of course) but also the legitimate client.

If an attacker wants to know how to talk to your Web service, he just has to reverse-engineer the client code. The client code is deployed in various places, it is a file written on disks and backup tapes and distribution mediums, it is also in the head of several developers, and the protocol may be documented and printed, so the attacker can scan the trash bins at the development site to obtain the information about the syntax. The WSDL can only help the attacker, but it would be a mistake to believe that without the WSDL the attacker is severely impaired.

As @Rook says, letting your Web service publish the WSDL is convenient for tests; it is also good for interoperability developments. Since any sane security policy has to assume that it is public or almost public anyway, you may at well leave it public.


It is possible to keep the WSDL private, or keep it cached on the client. However, this is just (in)security though obscurity. WSDLs are useful for generating test cases against your web service, and you should test your own service before any major release.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .