Improving Web Application Security: Threats and - CGISecurity

574 Part IV: Securing Your Network, Host, and ApplicationDisable Unused ProtocolsThe element defines the protocols that Web services support. By default,HttpPost and HttpGet are disabled on .NET Framework version 1.1 as follows:By disabling unnecessary protocols, including HttpPost and HttpGet, you reducethe attack surface area. For example, it is possible for an external attacker to embed amalicious link in an e-mail to execute an internal Web service using the end user’ssecurity context. Disabling the HttpGet protocol is an effective countermeasure.In many ways, this is similar to an XSS attack. A variation of this attack uses an tag on a publicly accessible Web page to embed a GET call to anintranet Web service. Both attacks can allow an outsider to invoke an internal Webservice. Disabling protocols mitigates the risk.If your production server provides publicly discoverable Web services, you mustenable HttpGet and HttpPost to allow the service to be discovered over theseprotocols.Disable the Automatic Generation of WSDLThe Documentation protocol is used to dynamically generate Web ServiceDescription Language (WSDL). WSDL describes the characteristics of a Web service,such as its method signatures and supported protocols. Clients use this informationto construct appropriately formatted messages. By default, Web services publiclyexpose WSDL, which makes it available to anyone who can connect to the Web serverover the Internet.At times, you might want to distribute the WSDL files manually to your partners andprevent public access. With this approach, the development team can provideindividual .wsdl files for each Web service to the operations team. The operationsteam can then distribute them to specified partners who want to use the Webservices.