Hi there

I've just stumbed upon something and would like to hear that i've
forgotten to do something. I've created a secure webservice using
UsernameTokenOverTransportAssertion. I'm using a
customUsernameTokenManager to authenticate the token as well.

All is well and fine and i can consume the webservice securely via my
client, and if i don't use the proper token it rejects me. However if i
simply browse to the asmx file i can see my methods and even invoke
some of them.

Is this a hole in the security? What's happening here? And what happens
if someone simply creates a reference to my webservice and only uses
the standard webservice and not the WSE suffixed one?

Any answers would be greatly appreciated!

Thanks
Damian