Limit access of asmx web service to specific IP addresses

Question

I need to limit access of an .asmx web service to specific IP addresses. I figure I could add a hardcoded check into each method, but that seems like a code maintenance nightmare. Is there a web configuration entry I can make, or a IIS 6 setting I can apply to the .asmx file?

Solution

In IIS 6.0 Manager, right click on the .asmx file.

Go to the File Security tab, and Click the Edit button in the IP Address and domain name restrictions.

Click the 'Denied Access' radio button, then add your whitelisted ip addresses to the list.

For IIS 7.5, it's a little tricky as the file doesn't show in the navigation panel. You need to go to the Content View tab (in the lower part of the window), right click on your file and choose Switch to Features View. Open IP Address and Domain Restriction, click on Edit Feature Settings and choose to deny unspecified hosts. Now you can add authorizations by clicking on Add Allow Entry.

Comments

[Moose]

I added the IIS way in another answer, but I'll stick with this one.. It keeps your whitelist in web.config where more of your site configuration is, and allows you to be more flexible if you want something fancier than whitelist or blacklist. I think this would be the more elegant solution. Also, the IIS metadata route could get lost if someone changes something down the tree and overwrites it.

[DMCS]

The problem is the code in each of the web service calls that gets bad to maintain and kept in all future additions to the .asmx file by other developers (which, undoubtedly, will forget). The Whitelist in IIS is the best way to keep it simple, so if changes do happen, a whole new codeset doesn't need to be sent thru QA (expensive process in terms of time and resources) and then redeployed (not quite as expensive as QA, but still wastes people's time). So the quickie thing to do is keep them in the IIS 6 whitelist. :)

[HarryTuttle]

Note that IP security is a feature which doesn't come preinstalled on Windows 7/IIS 7.5. You'll have to add it: iis.net/configreference/system.webserver/security/ipsecurity‌​/…

[Moose]

Good catch.. I didn't realize you have to add it separately.