Using WSE (1.x) on a per-WebMethod basis

Note: this entry has moved.

WSE is great for several things, but as stated in Programming with WSE 1.0, you have to add the extension in the Web.config. However, this causes ALL exposed WebMethods to require WSE processing, thus, you can't secure some of them and leave others as "plain" ASP.NET WebServices.

The solution is to use the other type of web service extension available on ASP.NET, an SoapExtensionAttribute-inherited class that can be applied to each desired attribute. The code for such an attribute class, allowing you to use WSE only on specific methods, follows:

[AttributeUsage(AttributeTargets.Method, AllowMultiple=false)]
public class WseExtensionAttribute : SoapExtensionAttribute
{
	public override Type ExtensionType
	{
		get { return typeof(WebServicesExtension); }
	}

	public override int Priority
	{
		get { return _priority; }
		set { _priority = value;    }
	} int _priority = 0;
}

Now you can use the attribute only on the methods that require WSE processing:

[WebMethod]
[WseExtension]
public void WseSecuredMethod()
{
}

[WebMethod]
public void NonWseMethod()
{
}

By looking at the WSE 2.0 Technical Preview "code", I can say this still holds true, so you will need this code anyway (except if they happen to add it!).