title: Web Service with AJAX Security Best practices
body: <p>i am using script manager to call a web method on client side but as you know web methods cant work from user control, so you have to create a web service to do that.</p>
  
  <p>this is going fine with me but i am having the following concerns</p>
  
  <ul>
  <li>if  you use web method in ASPX page the code is invisible to the user so how can i prevent users from browsing to my service and see my code and only let the page or user control call the web service. </li>
  <li>is there anyway users can high jack my code like Cross Site Scripting, Pinging, Etc... with this approach.</li>
  <li>what is exactly visible to the client with this approach, the java script code block that i used to call the service or everything ? </li>
  <li>any extra Advice would be totally appreciated.</li>
  </ul>