How do I restrict the WCF service called by an ASP.NET AJAX page to only allow calls for that page?

I have an AjaxControlToolkit DynamicPopulate control that is updated by calls to a WCF service. I know I can check the HttpContext in the service request to see if a user of the page (and thus, the control) is authenticated. However, I don't want anyone clever to be able to call the service directly, even if they're logged in. I want access to the service to be allowed ONLY to requests that are made from the page. Mainly, I don't开发者_StackOverflow want anyone to be able to programatically make a large number of calls and then reverse-engineer the algorithm that sits behind the service.

Any clever ideas on how this can be done? Maybe I'm over-thinking this?

Thanks in advance.

---

The simple answer is you can't. The complicated answer is you can fudge it with a lot of work, you could for example

1. Rate limit based on the IP of the caller.
2. Drop a cookie based upon the session and rate limit on that.
3. Drop a cookie based upon the page when the page loads and rate limit upon that.

However none is foolproof, and all can go wrong with legitimate requests.

---

If you really want to restrict this to just this one server making the request, you could add a certificate to that server and check for that certificate. However, you probably can't really limit access to just a single page calling your service.

You could add a lot of additional elements, like headers etc. - but none will really be totally sound - if someone is determined enough, they'll be able to figure out what you're doing, and replicate that.

So really: why do you need to limit this access this badly?

---

I solved this with a different approach. Instead of trying to secure the service to a single page, I just secured the service by checking HttpContext to make sure the user making the request is authenticated. This relies on ASP.NET Compatibility being enabled on the WCF service class: http://msdn.microsoft.com/en-us/library/ms752234.aspx

Then I have access to HttpContext within the service and can check that the call came from an authenticated user. =D