Home Library Learn Downloads Support Community
Sign in | United States - English | |
This topic has not yet been rated - Rate this topic

How to: Disable Protocol Support for Web Services 

.NET Framework 2.0

To help reduce the risk of inadvertent invocation of a Web service, you should disable protocol support when it is not required. You can disable protocol support for the whole machine or for individual Web applications.

To disable HTTP-GET and HTTP-POST protocols for the whole machine

  1. Open the Machine.config file in a text editor. (The default installation places Machine.config in the \Config subdirectory of the installation root.)

  2. Comment out the lines within the webServices section that add support for HTTP-GET and HTTP-POST, if they exist. After doing so, the webServices section should look like the following:

    Copy 
    <webServices>
    <protocols>
      <add name="HttpSoap"/> 
         <!-- <add name="HttpPost"/> --> 
         <!-- <add name="HttpGet"/>  -->
      <add name="Documentation"/>
      <add name="HttpPostLocalhost"/>
    </protocols>
</webServices>

  3. Save Machine.config.

    This configuration change takes effect on the next request to a Web service hosted on that machine.

To disable support for a protocol for an individual Web application

  1. Open the Web.config file in the root directory of the Web application in a text editor. (If a Web.config file does not exist, create one.)

  2. Modify the webServices section of Web.config to explicitly remove the protocol setting. The following example explicitly removes the HTTP-POST and HTTP-GET protocols:

    Copy 
    <webServices>
     <protocols>
       <remove name="HttpPost" />
       <remove name="HttpGet" />
     </protocols>
</webServices>

  3. Save Web.config.

    This configuration change takes effect on the next request to a Web service hosted by the Web application.

See Also

Did you find this helpful?
(1500 characters remaining)
Community Content Add
Annotations FAQ
.net 1.1?
Just wondering how this can be achieved in .Net 1.1 ? It seems in 1.1 all you can do is comment out the tags in machine.config at the risk of impacting all other web services on that machine. And adding the remove tag in 1.1 web.config crashes the web service.

Any pointers how it can be achieved in 1.1?

TIA

[tfl - 25 09 09] Hi - and thanks for your post. You should post questions like this to the MSDN Forums at http://forums.microsoft.com/msdn or the MSDN Newsgroups at http://www.microsoft.com/communities/newsgroups/en-us/. You are much more likely get a quicker response using the forums than through the Community Content. For specific help about:
.NET Framework : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public.dotnet.framework
PowerShell : http://groups.google.com/group/microsoft.public.windows.powershell/topics?pli=1
SQL Server : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public.sqlserver%2C&
Visual Studio : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public.vstudio%2C&
Windows : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public.windows%2C&
All Public : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public%2C&

History