0

Is there a way to serve up a custom "Sorry not found" page from a direct access request to a WCF Service (.svc file) on a server running IIS 6.0, and .NET 3.5 SP1.

I have a requirement that my service in a Production environment is not discoverable. The requirement states that WSDL publishing should be off, and the request also states that when directly accessing the MyService.svc file via a HTTP Get Request that a "Sorry Not found" page is displayed instead.

I have no problem disabling the metadata in the config file.

<serviceMetadata httpGetEnabled="false" />

But I can't figure out a way to not show the default .svc page.

SERVICE
This is a Windows© Communication Foundation service.

Metadata publishing for this service is currently disabled.

If you have access to the service, you can enable metadata publishing by completing the following steps to modify your web or application configuration file: ...

Also posted at Stackoverflow.

1

1 Answer 1

1

Can't you just restrict access using your clientaccesspolicy.xml or crossdomainpolicy.xml files?

You could also just host the service on a different port, if you're worried that someone will wander onto http://yoursite/service.svc

Example of a crossdomainpolicy.xml from yourdomain.com

<cross-domain-policy>
  <site-control permitted-cross-domain-policies="all" /> 
  <allow-access-from domain="*.yourdomain.com" secure="false" /> 
  <allow-http-request-headers-from domain="*" headers="*" secure="false" /> 
</cross-domain-policy>
1
  • No, it is a valid service and needs to work for HTTP Post, just not HTTP Get on the direct .svc page. Yes, it is a strange request, but Security Teams can be strange themselves. I personally don't think it is possible.
    – degnome
    Oct 27, 2009 at 21:22

You must log in to answer this question.