Question about Web Service Security

Hi,

I created a web service and secure it using SoapExtention. I implemented code from this link.

http://www.developer.com/net/net/article.php/11087_2192901_2

Now if I create proxy class from my other webapplication and call any webmethod of my webservice, I must provide username password to access any of its webmethod, otherwise it is throwing SOAP Exception which works fine.

But now when I open this webservice locally using its URL, in Internet Explorer, like http://localhost/MyWebService/poservice.asmx, it shows me all webmethods and I can invoke any webmethod from here without using UserName or Password, I mean even if I have implemented code as per above link using SoapExtention to authenticate each request, I am able to test this webservice using local URL without any username or password, so is this correct behav ...