ajax.remotecall,javascript - Securing a remote ajax method call - Stack Overflow

You can use SOAP to pass a username/password with the request. SSL should be used to encrypt the data going over the wire. Here is some code that we use:

This is a class that will hold the Credentials that are sent with the request:

Imports System.Web.Services.Protocols

Public Class ServiceCredentials

Inherits SoapHeader

Private _userName As String

Public Property UserName() As String

Get

Return _userName

End Get

Set(ByVal value As String)

_userName = value

End Set

End Property

Private _password As String

Public Property Password() As String

Get

Return _password

End Get

Set(ByVal value As String)

_password = value

End Set

End Property

Public Sub New()

End Sub

Public Sub NewUserInfo(ByVal ServiceUser As String, ByVal ServicePassword As String)

Me.UserName = ServiceUser

Me.Password = ServicePassword

End Sub

Add an attribute to the definition of your Web Service:

_

_

Function MyWebMethod(ByVal paremetersPassed as String)

'check permissions here

If PermissionsValid(CredentialsHeader) then

'ok!

.......

else

'throw a permission error

end if

End Function

And then from there, just create a function (in my example, PermissionsValid) to check the permissions:

Function PermissionsValid(byval Credentials as ServiceCredentials) as boolean

'check Credentials.Username and Credentials.Password here and return a boolean

End Function

This may seem like a bunch of work, but this way, when they send a request, you can check it against a database or whatever else you want. You can also turn off a username easily at your end.

A simpler way would be to restrict the IP addresses that are allowed to hit the service page. But, then you run into issues with IP addresses changing, etc.

BTW, much of this was typed as I did the post, so you may need to check over the code to make sure it compiles. :)