With all the webservices, what is the right way to handle security?

We need tell webservice what to return, if a webservice is a general one, we need pass paramters to it to tell what data it should return. I don't think it is a good idea to expose the parameters to clients. So I am think I will put some parameters for a webserice to session state. then give a GUID to webservice, with the GUID, the webservice can get the parameters from session state. But I found my webservice can not read the variable from session state. (they are on same site).

This really depends on the specific web service. If you are dealing with something that returns very public data (e.g. a weather service), then security is not much of a concern. But if your web service has the potential to fo bad things on the client, or return confidential data, you clearly have to be careful. Authentication is one way to deal with this.

David

Sorry, I forgot to address your other question. In order to use session, you need to use this attribute on the method:

[WebMethod(EnableSession = true)]

thanks.

I just need some guide from you, so I don't spend time on wrong direction.

As the EnableSession, I posted in another post. It doesn't work. The reason is I need put that on GetData, but GetData can not be override.

Please give me some idea, I really need it.