title: How do I protect a public ASMX page that posts important data to my database
body: <p>I have a site in development with several web services (ASMX) that post important data to my database. When I navigate to the ASMX file in my browser, I can fill in the form with the parameters and post to the DB. If someone finds the URL to my WS, they can severely alter my database. I want to prevent people from being able to post to my WS publicly. So far, I've thought of two things that may help but I'd like to know if there are any other ways:</p>
  
  <ul>
  <li>Check to see if the HTTP Referrer to the WS method is the domain the WS is on</li>
  <li>Add an additional parameter called <strong>Key</strong> to all important WS methods and have this be an encrypted "password." Then encrypt my stored password on the WS side and compare if the keys match.</li>
  </ul>
  
  <p>If there are any other best practices or techniques I can use to secure my WS, please share!</p>