Asmx web service basic authentication

Question

I want to implement basic authentication using username and password validation in my asmx web service. I don't want to use WCF and I know this is not secure way, but I need to use basic authentication without using https. My web service is like this: ``` [WebService(Namespace = "http://www.mywebsite.com/")] public class Service1 { [WebMethod] public string HelloWorld() { return "Hello world"; } } ``` And I use this custom HttpModule: ``` public class BasicAuthHttpModule : IHttpModule { void IHttpModule.Init(HttpApplication context) { context.AuthenticateRequest += new EventHandler(OnAuthenticateRequest); } void OnAuthenticateRequest(object sender, EventArgs e) { string header = HttpContext.Current.Request.Headers["Authorization"]; if (header != null && header.StartsWith("Basic")) //if has header { string encodedUserPass = header.Substring(6).Trim(); //remove the "Basic" Encoding encoding = Encoding.GetEncoding("iso-8859-1"); string userPass = encoding.GetString(Convert.FromBase64Stri…

Accepted Answer

Change your custom HttpModule code to this:

```
public class BasicAuthHttpModule : IHttpModule
{
    public void Dispose()
    {
    }

public void Init(HttpApplication application)
    {
        application.AuthenticateRequest += new 
            EventHandler(this.OnAuthenticateRequest);
        application.EndRequest += new 
            EventHandler(this.OnEndRequest);
    }

public void OnAuthenticateRequest(object source, EventArgs
                        eventArgs)
    {
        HttpApplication app = (HttpApplication)source;

string authHeader = app.Request.Headers["Authorization"];
        if (!string.IsNullOrEmpty(authHeader))
        {
            string authStr = app.Request.Headers["Authorization"];

if (authStr == null || authStr.Length == 0)
            {
                return;
            }

authStr = authStr.Trim();
            if (authStr.IndexOf("Basic", 0) != 0)
            {
                return;
            }

authStr = authStr.Trim();

string encodedCredentials = authStr.Substring(6);

byte[] decodedBytes =
            Convert.FromBase64String(encodedCredentials);
            string s = new ASCIIEncoding().GetString(decodedBytes);

string[] userPass = s.Split(new char[] { ':' });
            string username = userPass[0];
            string password = userPass[1];

if (!MyUserValidator.Validate(username, password))
            {
                DenyAccess(app);
                return;
            }
        }
        else
        {
            app.Response.StatusCode = 401;
            app.Response.End();
        }
    }
    public void OnEndRequest(object source, EventArgs eventArgs)
    {
        if (HttpContext.Current.Response.StatusCode == 401)
        {
            HttpContext context = HttpContext.Current;
            context.Response.StatusCode = 401;
            context.Response.AddHeader("WWW-Authenticate", "Basic Realm");
        }
    }

private void DenyAccess(HttpApplication app)
    {
        app.Response.StatusCode = 401;
        app.Response.StatusDescription = "Access Denied";
        app.Response.Write("401 Access Denied");
        app.CompleteRequest();
    }
}
```

Then enable `Anonymous authentication` and disable `Basic`, `Digest` and `Windows` authentication for your website in IIS.

Note: This implementation will work with WCF too.

Asmx web service basic authentication

Solution

Problem