use webservice?

[Christopher Brandsdal]

Hi!

I want to be able to read and write to the file-system(using an vb.net
object) on a webserver I have from an application I made that runs on
several of my computers around the world. I want to make an vb.net object
that does everything I want on the this server. This is ok so far. I guess I
could just make, and call a web service in my application that both sends
read and write commands to the object/file system. This would work fine. But
what about the security? I dont want others to be able to run this web
service. If somebody else could find the web service, they would be able to
write to my server. Is there any good, secure way to authorize the web
service user? There has to be a way to do this. What if I made a service
that only reads from a database, but I don't want everybody on the net to be
able to use it? Sorry for my bad english. New to web service.

Hope anyone understands what I mean

Best regards,
Christopher W. B.

 

[Andrew Brook]

Hi Christopher,

Well, I haven't personally had to deal with this side of things, but it's
fairly common I guess. I think you can either secure the HTTP connection
(HTTPS), or encrpyt the web service SOAP messages using WSE.
You should be able to google a little to find out more.

thanks,
Andrew

 

[Christopher Brandsdal]

Thanks!

So it might be common to set username and password(or something like that)
on a web service?

I read abot the encryping yesterday. Seems ok. I was just wondering if I was
missing something here. I have not found many articles on using webservice
to update into database or something like that.

 

[Andrew Brook]

You could definitely set a username and password parameter on your
webservice method, or require some unique identification code. But if the
data being transferred across the wire is readable then it's not
particularly secure if someone was to intercept and examine the
requests/responses.

WSE can be used to encrypt the messages being sent over the wire so this
isn't a problem. However, I seem to recall reading that there may be
problems with this method if you're using technologies other than .NET as
clients (you'd probably want to checkup on that if this applies to you).

HTTPS sounds like the simplest to me, but again, i think i recall reading
that there is a slight performance hit associated with this method.

goodluck, and feedback any further info you find or what choice you make in
the end, would be interested to see what approach you take.
thanks,
Andrew

 

[Christopher Brandsdal]

Thanks Andrew!

I will post back when I have started coding.