Geek Answers Handbook

How to protect my server methods

I just read some posts about hiding Silverlight code. The main conclusion was that you can confuse it, but you cannot hide it, so safe things must be done on the server. But then anyone can see through Fiddler what data is sent to a particular web service. For example, they can see that I am calling UpdateCustomer.asmx. And if they do, what can I do to prevent them from calling this asmx? Is there a way to allow only “my Silverlight application” to call this method?

+5
source share
2 answers

I assume that if you want to be truly paranoid, you can combine all the calls from your client application through one endpoint of the web service and encrypt the payload ... something like:

  • Client application hits endpoint "givemeatoken.asmx"
  • The server generates a key token
  • The client encrypts all calls using the specified token, passing them to one endpoint "onlyservice.asmx"
  • The server decrypts the payload of calls using a token and routes the calls to the "real" web services.
  • The server retrieves the results of the call, re-encrypts with the token, and passes it back to the client
  • The client decrypts the results and does what he should do.

... , Silverlight, , "" . , ; , ( , )

0

. - Silverlight, , . , , .

, - URL ? , ?

+1

More articles:


All Articles