Force SSL

[Scott]

Is there a way to check if the current (web service)connect ion is using
ssl? I'd like to be able to check for this and return an error if the
connection isn't secure. I work in a heavily regulated industry and
can't send data over a non-secure connection.

Thanks.
Scott C.

[Tom at SDI]

Re: Force SSL

I assume you have your web server set up with normal access
(http://mysite.com) in one IIS directory and SSL access (https://mysite.com)
in a separate directory. As long as your web service runs as an application
in only the https directory, can you not just assume you're running SSL?

Tom

"Scott" <me@me.com> wrote in message
news:ekdWbBNiFH A.1464@TK2MSFTN GP14.phx.gbl...[color=blue]
> Is there a way to check if the current (web service)connect ion is using
> ssl? I'd like to be able to check for this and return an error if the
> connection isn't secure. I work in a heavily regulated industry and
> can't send data over a non-secure connection.
>
> Thanks.
> Scott C.[/color]

[Jani Järvinen [MVP]]

Re: Force SSL

Scott,
[color=blue]
> Is there a way to check if the current (web service)connect ion is using
> ssl?[/color]

You can use the Context property of the web service class to read the
Request.IsSecur eConnection property to test if the call came through HTTPS
(SSL). For example:

bool isSecure = Context.Request .IsSecureConnec tion;

Another option is to make sure the web server (or the firewall in front of
it) is configured so that it doesn't accept any connections through HTTP,
i.e. unsecured connection. You might want to do this in addition to your own
application tests to take use of the "defence in depth" principle.

Thirdly, you might wish to encrypt contents of the messages itself, which
would add even more security. However, this might be wasting CPU cycles
unnecessarily if SSL is already enough for your application.

Hope this helps.

--
Regards,

Mr. Jani Järvinen
C# MVP
Helsinki, Finland
janij@removethi s.dystopia.fi

http://www.saunalahti.fi/janij/

[Tom at SDI]

Re: Force SSL

Jani ,

I find myself in a similar situation to Scott. I am working on a WebService
that will be running over SSL, but there is some data that is seen by my
company as particularly sensitive. You mention the possibility of
encrypting messages. Is there an easy way to force certain web service
parameters or function calls to be "encrypted" ?

Thanks,

Tom

"Jani Järvinen [MVP]" <janij@removeth is.dystopia.fi> wrote in message
news:eHRygSViFH A.2180@TK2MSFTN GP15.phx.gbl...[color=blue]
> Scott,
>[color=green]
>> Is there a way to check if the current (web service)connect ion is using
>> ssl?[/color]
>
> You can use the Context property of the web service class to read the
> Request.IsSecur eConnection property to test if the call came through HTTPS
> (SSL). For example:
>
> bool isSecure = Context.Request .IsSecureConnec tion;
>
> Another option is to make sure the web server (or the firewall in front of
> it) is configured so that it doesn't accept any connections through HTTP,
> i.e. unsecured connection. You might want to do this in addition to your
> own application tests to take use of the "defence in depth" principle.
>
> Thirdly, you might wish to encrypt contents of the messages itself, which
> would add even more security. However, this might be wasting CPU cycles
> unnecessarily if SSL is already enough for your application.
>
> Hope this helps.
>
> --
> Regards,
>
> Mr. Jani Järvinen
> C# MVP
> Helsinki, Finland
> janij@removethi s.dystopia.fi
> http://www.saunalahti.fi/janij/
>
>[/color]

[Scott]

Re: Force SSL

Jani Jdrvinen [MVP] wrote:
[color=blue]
> You can use the Context property of the web service class to read the
> Request.IsSecur eConnection property to test if the call came through
> HTTPS (SSL). For example:[/color]

Thanks Jani, this is exactly what I was looking for.

Scott C.

[Scott]

Re: Force SSL

Tom at SDI wrote:
[color=blue]
> I assume you have your web server set up with normal access
> (http://mysite.com) in one IIS directory and SSL access
> (https://mysite.com) in a separate directory. As long as your web
> service runs as an application in only the https directory, can you
> not just assume you're running SSL?[/color]

Goverment regulators rarely accept these types of assumptions. <g>

Scott C.

[Jani Järvinen [MVP]]

Re: Force SSL

Tom,
[color=blue]
> You mention the possibility of encrypting messages. Is there an
> easy way to force certain web service parameters or function
> calls to be "encrypted" ?[/color]

I'm not aware of any easy, single silver-bullet method or property you could
use to just "set encryption on". Instead, there are nowadays many web
services security related specifications, such as WS-Security which uses a
W3C specification "XML Encryption" underneath, among others. From the
programmer's perspective this means that there are many options to solve the
issues, too.

A full introduction to web services security would require much more than
I'm able to give you here, however I can give you some pointers. For
instance, MSDN has an article named "Web Services Security Specifications
Index Page", which probably would be interesting to you:

http://msdn.microsoft.com/webservice...rspecindex.asp

Secondly, the article "Understand ing WS-Security" might be useful:

http://msdn.microsoft.com/webservice...l/understw.asp

Also, .NET 2.0 has better support for web services and and security, however
I must say I haven't yet studied their potential in full when it comes to
this area of the class library. Nonetheless, support for XML encryption and
signing already exists in the library (I'm talking about version 1.1 as well
as the 2.0 betas), see for example the System.Security .Cryptography.X ml
namespace.

Hope this will give you good a starting point! Have a nice weekend, too.

--
Regards,

Mr. Jani Järvinen
C# MVP
Helsinki, Finland
janij@removethi s.dystopia.fi

http://www.saunalahti.fi/janij/

[Chad Z. Hower aka Kudzu]

Re: Force SSL

"Scott" <me@me.com> wrote in news:ekdWbBNiFH A.1464@TK2MSFTN GP14.phx.gbl:[color=blue]
> Is there a way to check if the current (web service)connect ion is using
> ssl? I'd like to be able to check for this and return an error if the
> connection isn't secure. I work in a heavily regulated industry and
> can't send data over a non-secure connection.[/color]

IIS can do this too. Go to the app configuration and there is an option for "Secure only"


--
Chad Z. Hower (a.k.a. Kudzu) - http://www.hower.org/Kudzu/
"Programmin g is an art form that fights back"

Blogs: http://www.hower.org/kudzu/blogs