0

I have a .net webservice like http://tempurl.org/webservice.asmx I want to call it using Javascript, maybe some jquery lib. Q1: How to limit the access only to myself? Q2: or How to implement a role based authentication.

Edit: I want to deploy the webservice independently like:

ProjectA
ProjectB
ProjectWebService

I need People login in ProjectA and ProjectB and can use ProjectWebService.

hbrls
  • 2,110
  • 5
  • 32
  • 53

1 Answers1

1

just a suggestion, as you know theres many ways to skin a cat so heres one. Firstly enable session state across calls to the service using

 [WebMethod(EnableSession = true)]

Then have a web service method for login that saves the user details to the session, this supports the standard Membership provider for asp.net, warning sample code

 public bool Login(string userName, string password)
 {
      //validate login
      var user = Membership.GetUser(userName);
      var valid = Membership.ValidateUser(user.UserName, password));
      if (valid)
          HttpContext.Current.Session["user"] = user;
      return valid;
 }

Then you can in a web service method validate against the user.

public void SomeServerMethod()
{
    var user = HttpContext.Current.Session["user"]; 

    if (user == null)
         throw new Exception("Please login first");

     if (user.IsInRole("FooRole")
             DoStuff();
     else
         throw new Exception("Seriously? dude you dont have those rights");

 }

To counter network easedropping best go to Https, good luck :)

almog.ori
  • 7,839
  • 1
  • 35
  • 49
  • New problem please. I have 2 projects under 1 solution. The user login in Project1 and use webservice in Project2. The `session` seems not to be carried on. – hbrls May 06 '11 at 09:08
  • Are you hosting two sites? how are the projects accessed? can you explain a bit more... – almog.ori May 06 '11 at 09:34
  • Something like: `user.site.com`, `admin.site.com`, `webservice.site.com`. One site, three different modules. – hbrls May 06 '11 at 09:48
  • 1
    check out this link http://stackoverflow.com/questions/2868316/sharing-sessions-across-applications-using-the-asp-net-session-state-service – almog.ori May 06 '11 at 10:05