Solved

Does my Silverlight/Web Service solution have a security vulnerability?

Posted on 2011-03-08
2
531 Views
Last Modified: 2012-05-11
I'm building one of my first silverlight applications.  The silverlight will be hosted within Microsoft CRM 2011 Online.  It will need to access a web service that I am creating that is hosted on the clients server which is a different domain than the silverlight application.  

Users who access the silverlight application via CRM 2011 have already been authenticated by CRM and have permission to access the data in the web service.  The webservice doesn't need to know which user is making the request, just that it is an authenticated user of CRM.  

I am planning on setting up SSL on the server that hosts the web service and adding the domain of the crm system to the crossdomain.xml file.

Because this is my first silverlight application I'm concerned that I may accidentally be leaving a security vulnerability.  I would appreciate a response on whether.

1.  My solution is vulnerable to data being intercepted when it is communicated between Silverlight and the webservice.

2.  My solution is vulnerable to impersonation by a malicious user trying to query the web service.

3.  If there are any other security vulnerabilities I need to be aware of.

Thank you for your consideration.
0
Comment
Question by:sanw2020
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
2 Comments
 
LVL 40

Accepted Solution

by:
Kyle Abrahams earned 500 total points
ID: 35072175
for 1:  use HTTPS . . . optionally you can also encrypt the results of a service call before sending and decrypt them locally.

for 2: Not sure how you're sharing the token.  If you're using windows auth impersonation is always possible.

for 3:  In general assume the client is always compromised.  All validation should be server side.

General securing tips:
http://msdn.microsoft.com/en-us/magazine/ff646975.aspx
0
 
LVL 40

Expert Comment

by:Kyle Abrahams
ID: 35258482
Do you need further assistance?
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Confluence of Individual Knowledge and the Collective Intelligence At this writing (summer 2013) the term API (http://dictionary.reference.com/browse/API?s=t) has made its way into the popular lexicon of the English language.  A few years ago, …
New Relic recently released its Synthetics product that allows for the creation of performance monitors that periodically test a site's performance. If you wish to test an interactive workflow New Relic employs Selenium WebDriverJS to run those test…
The purpose of this video is to demonstrate how to set up the WordPress backend so that each page automatically generates a Mailchimp signup form in the sidebar. This will be demonstrated using a Windows 8 PC. Tools Used are Photoshop, Awesome…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question