Custom Security For ashx Handler - c#

In my WCF web service I have a custom ashx handler. It is designed so that a person can call the web service and get a dynamic link to download a file.
So, an IIS server which is serving up a page to a client calls the web service. This generates the link. The link can be handed to the client machine (i.e. they will be running a web browser) and their browser can open the link. The link will be to the ashx handler, and the result will be that the file gets downloaded.
For the WCF service over all it is using windows authentication because the service is not public, but I want to allow anonymous authentication for the ashx handler because that could be called from any number of client machines.
Any ideas?
Thanks.

I'd recommend moving the ashx handler and file download functionality to a separate application root so that you can configure it with anonymous access. Decoupling the web service from the file download service would also let the two live on different servers, potentially solving firewall issues that you may encounter later if the download service needs to be accessed externally but you need to keep the web service private.

Related

Which server side app should I pick for file transfare scenario

I created some chrome extension that detects a file download event and cancel the download, and gets the download link. Sends the link to myserver.
I want to create a server that recive link to download, download the file, do some manipulation on the file and sends the file back to client.
All the time I developed client side apps (Mainly with c#), and I don't know what to choose for the server side, WCF App or Web API (or something else). the server can be inside the organisation or remote.
What do you think should I pick? any suggestions?
It seems that creating Restful-style services may be more appropriate for this scenario.
You know, both WCF and Asp.net WebAPI can create Restful-style services. WCF could take advantage of the Webhttpbinding to create it.
As for handling file uploads and downloads, I don't think there is any difference between the two techniques. Perhaps the services created by Asp.net WebAPI are a little more mature, such as the ability to deal with form-data stream (multipart/form-data) directly. While WCF service could not directly process the form-data stream.
Here is an example of an upload and download in Asp.net WebAPI.
https://learn.microsoft.com/en-us/aspnet/web-api/overview/advanced/sending-html-form-data-part-2
How to return a file (FileContentResult) in ASP.NET WebAPI
Feel free to let me know if there is anything I can help with.

How to call windows service methods from web application

I need to develop windows service which will do fortnightly transfers of files into the system. The problem is that I will also need "RunNow" method, so users can call transfer method any time by clicking to the link in the web app (asp.net mvc).
How can I call my windows service methods from external resource?
If you want to call a windows service method on the server side of your web application then take a look at the WCF or RestSharp and Nancy. Shortly, you need to create a RESTfull service in the windows service application that will be using a http://localhost/myservice/transfer address to expose the Transfer method. Then use ajax from your javascript code or RestRequest from your .net-controller class to call the address.
But if you want to call a windows service method on the client side of the application it will be a problem.
You could use Microsoft Message Queuing
The Webapplication would send a Message that the Service picks up.
Queue-Based Background Processing in ASP.NET MVC Web Application
http://msdn.microsoft.com/en-us/library/ms978430.aspx

WCF Service and ajax call in same project

I hav a C# web application. In that I have added a WCF Service file (.svc) by Right Click project Add New Item >> WCF Service (wcfService.svc). ( Now I have IwcfService.cs and wcfService.cs in my App_Code folder) And also added a function WCFXmlData(string id) inside that.
I am trying to access the function inside wcf service file from an ajax call in my application (in an aspx file).
But I am not able to do that.
Also I tried to browse this .svc file directly. There I got a message like Metadata publishing for this service is currently disabled.
That really depends on your binding, if you use the WebHttpBinding you can simple access the data via a browser. In best case you should modify your contract in such a way that it returns JSON, this is less overhead than XML or even SOAP (which uses also XML).
It your webpage is also implemented in the webservice you have nothing special to care about, but if your service runs under another subdomain you need to implement JSONP or Cross-Origin Resource Sharing (CORS) to manage cross domain calls.

Web Service deployment in IIS?

I started learning web services. I learnt about web services, UDDI, WSDL, SOAP etc. and architecture of web services. Visual Studio is running the service in local system successfully.
Then I deployed the entire folder of that web service in IIS wwwroot, and tested. Its running successfully.
But when I remove the other file from the wwwroot\webService1 folder (I left only service1.asmx and bin folder) then also service is running.
Here I see that only two file are used in ruuning the webservice one is .asmx and another one is webService.dll in bin folder.
I'm not able to understand where is SOAP, WSDL, namespace or other things, that are required to run web service.
Please clarify.
SOAP, WSDL, Namespace are all handled by IIS and ASP.NET. In your scenario, your web service endpoint is your asmx file (no .cs file required in your deployment), and the DLL in the bin folder contains the code that you wrote for your webservice (so it does something).
If you call up your webservice in a web browser, you should see your web methods listed out to test. IIS knows how to process *.asmx files to do this. If you click on one, you should see a sample form (if input parameters are expected) and a button. Again, IIS knows how to serve this out to you. When you click the button, IIS and ASP.NET handle the work of SOAPing your request, handling it with your code, and SOAPing the response back to you.
If you create a "test" project in Visual Studio, and set a web service reference that points to your deployed web service, Visual Studio will create a proxy class and pull in some additional code from it's discovery of the service. Try it. You should get at least: a WSDL which defines your web service, a file called reference.cs which contains the code that does the heavy lifting of calling your webservice (SOAPing the request from your application and unSOAPing from the response).
If you download a tool called Fiddler, you should be able to intercept and inspect the SOAP call to your web service.
Take a look at Web Services with ASP.NET for additional information.
There are no such 'files' at all. The asmx and dll files contain all of the code for the service. You can see some of that in the URLs that are requested for the SOAP/WSDL info.
I believe if you append ?WSDL after .asmx you will see the definitions.
Such as this example:
WSDL Example
I think these are protocols and does not require anything. IIS and the requesting applications understand these protocols.

How do I secure ASP.NET web service to only allow relative path calling?

I have ASMX services for my web application that I would only like available to the same application.
Is there a way for the web service to only be accessible by the same application, such as relative/absolute path restrictions?
The easiest route would be to just not use a web service. If you're calling from the same application, you can probably just pull your logic into a separate class, and call it directly in your code, not via web service.
Two ways to do this:
Have the web services hosted on a different box. The main web box is on a publicly accessible IP (ie. in the DMZ), while the web service box is only accessible to the internal network.
You might be able to do this with sufficient networking gymnastics. For example, host the web services on the same box but a different IP, and have the firewall block any outside calls to that IP.
Web services can be called by all sorts of code, not just code that's part of a web site. So, in general, there is no "calling URL".

Categories