I was reading a post about script services and security. In it, they say that you GET-enable a service by adding [ScriptMethod(UseHttpGet = true)]. It also states that the request will be denied if the content-type is not set to "json" in the http header. *However, I find neither of these things to be true!* The following method will return a 500 error unless I add <add name="HttpGet"/> in the web config which I do NOT want to do. Secondly, I am able to call the method using the following script include: (the article states it should NOT because the content-type is not "json"). Help! This is a huge security flaw that I need to patch!
<script src="http://localhost/AuthTestSvc/WebService1.asmx/HelloWorld"></script>
[System.Web.Script.Services.ScriptService]
public class WebService1 : System.Web.Services.WebService
&nb ...
Go to the complete details ...