You should still be mindful of the potential for cross-site request forgery. That’s not unique to ASMX or web services, but is too often overlooked.

ASP.NET page-

 
 
 
 
 
 
 
    function ddlChange() {
 
        var params ='{selectedItem:'+ $("#DropDownList1 option:selected").val() +'}';
 
 
        $.ajax(
 
    {
 
        type: "POST",
 
        url: "Customer.asmx/GetCustData",
 
        data: params,
 
        contentType: "application/json; charset=utf-8",
 
        dataType: "json",
 
        success: function(msg) {           
            var items = msg.d;           
 
            if ($(items).length > 0) {
                $("#lblCustName").text(items.name);
                $("#lblCustAddr").text(items.address);
            }
            else {
                alert("No records found");
            }
 
        },
        error: function(XMLHttpRequest, textStatus, errorThrown) {
 
            alert(textStatus);
 
        }
 
    });
 
    }

Web services-

 
[WebMethod]
        [ScriptMethod(ResponseFormat = ResponseFormat.Json)]
        public CustomerData GetCustData(string selectedItem)
        {
            try
            {
                CustomerData cust = new CustomerData();
 
                if (selectedItem.Equals("1"))
                {
                    cust.name = "Jake";
                    cust.address = "NJ";
                }
                else
                {
                    cust.name = "Roger";
                    cust.address = "CA";
                }
                return cust;
 
            }
            catch (Exception ex)
            {
                throw ex;
            }
 
        }

code from jQuery
…
// Allow a pre-filtering function to sanitize the response
// s is checked to keep backwards compatibility
if ( s && s.dataFilter ) {
data = s.dataFilter( data, type );
}

// The filter can actually parse the response
if ( typeof data === “string” ) {
// Get the JavaScript object, if JSON is used.
if ( type === “json” || !type && ct.indexOf(“json”) >= 0 ) {
data = jQuery.parseJSON( data );

// If the type is “script”, eval it in global context
} else if ( type === “script” || !type && ct.indexOf(“javascript”) >= 0 ) {
jQuery.globalEval( data );
}
}
…

As long as you don’t trust the client too much, a user finding the service’s URL isn’t any more dangerous than them knowing the ASPX page’s URL.

For example, if you were building an AJAX shopping cart, you shouldn’t ever accept a price from the client-side. Instead, you should always accept a product ID and retrieve its price from a secure, server-side data store (probably a database). That way, even if the user does find the service URL and figure out how to manually POST to it, the “worst” they can do is add legitimate items to their cart at full price.

Thanks

Any way to apply this sort of filter when using get() or getJSON()?

Thanks again!

Chas

Cheers Dave