HOW TO: Disable the Documentation Protocol for ASP.NET Web Services (815149)

This step-by-step article describes how to disable the documentation protocol for ASP.NET Web services.

ASP.NET Web services facilitate the development of Web services clients by automatically generating documentation that describes how to communicate with the Web service. Web services that have the documentation protocol enabled generate an HTML-formatted page when a browser request is received. This HTML-formatted page describes the following information:

• The operations that are supported
• The parameters that each operation accepts
• The type of data that should be passed in those parameters

The documentation protocol also generates an XML-formatted Web Services Description Language (WSDL) file. This file is designed to allow applications to understand how to structure requests to the Web service.

This information can be very useful to developers, especially developers who create clients for public Web services. However, revealing detailed information about the functionality of private Web services increases the risk that the Web service will be misused by a malicious attacker. The Documentation protocol always describes all functions and parameters of a Web service - even if only a subset of those functions are intended to be publicly accessible.

back to the top

Removing the Documentation Protocol

To disable the Documentation Web services protocol for an ASP.NET application, follow these steps:

1. Open the Web.config file from the web application's root directory in a text editor (for example, Notepad). If the Web.config file does not exist, create a Web.config file for the ASP.NET Application.
2. Add the webServices configuration element to the system.web element in the Web.config file.
3. In the webServices element, add the protocols configuration element.
4. In the protocols element, add the remove name="Documentation"/ element.
   
   The following example shows the webServices configuration element added to a Web.config file to disable the automatic generation of browser-friendly documentation:

   <webServices>
       <protocols>
           <remove name="Documentation"/> 
       </protocols>
   </webServices>

5. Save the Web.config file.

back to the top