Re: code access security across the network

There is no reliable way to identify calling code over a network. The only
interaction with the calling code is data sent over the wire, and any data
used to identify the caller can be spoofed by a malicious caller. Since
attempting to verify calling code identity is essentially a waste of time,
your efforts would be better placed on ensuring that your web service
functions correctly even when invoked by an "unexpected" caller. For most
applications, this would involve not trusting self-declared client user
identity and re-validating all data on the server side.


<ajfish@xxxxxxxxxxxxxxxx> wrote in message
news:1152632395.879802.205480@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi,

I have a client/server application where the server uses asp.net web
services.

is there any way I can use code signing, strong names or whaterver to
verify the identity of the client code across the web service call?

TIA

Andy



.

Relevant Pages

  • Re: returning custom class from web service
    ... I can't help you with being able to call public functions. ... As far as returning the class, in your calling code, you can't ... refer to the class assembly itself like you do in your web service. ... Also I want to call public functions of that type at client ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • Re: code access security across the network
    ... with web services, such as all of the various HTTP auth protocols (basic, ... only interaction with the calling code is data sent over the wire, ... data used to identify the caller can be spoofed by a malicious caller. ... client user identity and re-validating all data on the server side. ...
    (microsoft.public.dotnet.security)
  • Re: malloc()/realloc() - have I got this right?
    ... For some reason that is beound me you elected to ignore CBF's next ... The debate was whether the caller or the callee should disambiguate ... this to be done by the calling code. ... The client has to ...
    (comp.lang.c)
  • Re: Webservice that references other .Net libraries
    ... How can I ensure that the client has the class available? ... Kev ... > primitive types or types that are available in the framework. ... how do I ensure that my calling code is aware ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Handling empty relation to child object
    ... but you won't have to check for Client = ... > In the calling code I do: ... > this will throw an error if, for whatever reason, the Client does not ... > How can I get it to return an empty string instead of having to do: ...
    (microsoft.public.dotnet.languages.vb)