Improving Web Application Security: Threats and - CGISecurity

342 Part III: Building Secure Web ApplicationsSpecifically, examine the element in the .wsdl file and verify that itpoints to the expected location. If you use Visual Studio .NET to add a Web referenceby using the Add Web Reference dialog box, scroll down and check the serviceendpoints.Finally, whether you use Visual Studio.NET to add a Web reference or manuallygenerate the proxy code using Wsdl.exe, closely inspect the proxy code and look forany suspicious code.Note You can set the URL Behavior property of the Web service proxy to Dynamic, which allowsyou to specify endpoint addresses in Web.config.Code Access Security ConsiderationsCode access security can limit the resources that can be accessed and the operationsthat can be performed by your Web service code. An ASP.NET Web service is subjectto ASP.NET code access security policy, configured by the Web service’s element..NET Framework consumer code that calls a Web service must be granted theWebPermission by code access security policy. The precise state of theWebPermission determines the range of Web services that can be called. Forexample, it can constrain your code so that it can only call local Web services orservices on a specified server.If the consumer code has full trust, it is granted the unrestricted WebPermissionwhich allows it to call any Web service. Partial trust consumer code is subject to thefollowing limitations:● If you call a Web service from a Medium trust Web application, by default you canonly access local Web services.● Consumer code that uses the WSE classes must be granted full trust.For example, if your Web service proxy classes derive fromMicrosoft.Web.Services.WebServicesClientProtocol, which is provided by theWSE, full trust is required. To use WSE from a partial trust Web application, youmust sandbox calls to the Web service.For more information about calling Web services from partial trust Web applications,see Chapter 9, “Using Code Access Security with ASP.NET.” For more informationabout WebPermission, see the “Web Services” section in Chapter 8, “Code AccessSecurity in Practice.”