Forum

Hi

Can anyone please advise me on the best way (or easiest way perhaps :-)  to secure a web service for use from a DNN module?

I use a web service (.asmx) in a module I'm developing based on System.Web.Services.WebService.

I did find some articles here:
http://www.dnnsoftware.com/wiki/page/web-services

But I'm not sure how current these methods are.

Best Regards,

Steve 

Steve

Hi Scott,

Thank you for your reply. I was considering a GUID which i could include encrypt/decrypt, but i will take a look at your videos on the DNN API first.

Steve

Hi Scott,

I've changed my code to use the DNN Web Api, incorporating the security features mentioned in your client centric module development videos.

But on this page: http://www.dnnsoftware.com/wiki/page/services-framework-security

It says to use 'serviceFramework.getAntiForgeryProperty' on the data parameter of the Ajax call to include the anti-forgery token, there's an example:

data: serviceFramework.getAntiForgeryProperty({ NotificationId: action.NotificationId }),

Your example uses knockout to create the data, as i'm not familiar with knockout i can't see what's going on there.

So I tried using a variable which contains my JSON as follows:

data: serviceFramework.getAntiForgeryProperty(myjsonvariable),

But this doesn't work. i.e. the server side function isn't reached, no error was generated either.

So how should i wrap my JSON, which works without the call to getAntiForgeryProperty but doesn't work with it?

Also, finally, how can I best test that security is working? Use Fiddler to intercept the call and change the token, and ensure the call fails? I haven't used fiddler much, but before i invest a load of time on it, does that sound a reasonable approach?

Best Regards,

Steve