Question: I have a .NET web service which is publically accessible since it needs to be accessible via [Flex](http://www.adobe.com/products/flex/). It currently only has read operations.

> 
> <http://www.example.com/webservices/weather.asmx?wsdl>
> 
> 
> 

I want to add some admin only web methods to the same webservice such as `UpdateWeather` and `StartRainstorm`. Obviously I don't want my end user being able to do change weather patterns. 

So I just want to hide the wsdl so that it cannot be accessed via the standard `?wsdl` parameter. Ultimately I'll add on better security etc. but I need a quick fix for now. I figure if they don't know the method name they won't be able to access it.

I want to be able to disable the WSDL generation - which I can do by adding [`<add name="Documentation" />`](http://msdn.microsoft.com/en-us/library/ms242494.aspx) to my web.config. BUT I want to be able to access the WSDL in some other 'secret' way that only I know so I dont have to keep going to the server. How could I achieve this. I'm fine if its a secret URL or a secret parameter or whatever.

I'm fine with this [security through obfuscation](http://encyclopedia2.thefreedictionary.com/Security+by+obfuscation) approach for now.

Answer: 
One thing you could do is expose another endpoint for the admin contract. Then turn off the WSDL publisher on that admin endpoint. Eventually you could configure security just on the administrative endpoint if you wanted.

This is assuming you are using WCF.

**Update:** Check out this [WCF getting started tutorial](http://msdn.microsoft.com/en-us/library/ms734712.aspx). You'll like WCF more than ASP.NET/ASMX services once you learn a bit about it.
For update references, you could use your development server.
The production server cannot expose wsdl docs unless you provide public access.

Or, if you have access to the wcf assembly, you can use svcutil against the wcf assembly. This will generate language code to be used in your application.

If you really, really want to expose wsdl to limited users, you can use the iis url rewriting to block access from unauthorized ip addresses.