ASP.NET WCF metadata enabled for behavior

Description

This web application is configured with the serviceMetadata property httpGetEnabled / httpsGetEnabled set to true. When configured this way, the WCF service metadata (e.g. WSDL) will be publicly accessible.

Remediation

It's recommended to disable service metadata publishing by setting the <strong>serviceMetadata</strong> property <strong>httpGetEnabled / httpsGetEnabled</strong> to <strong>false</strong>. <pre> &lt;serviceMetadata httpGetEnabled=&quot;false&quot; httpsGetEnabled=&quot;false&quot; /&gt; </pre>

References

Related Vulnerabilities