WCF Odata - Disable meta data ($metadata)?

Question

I have a c# application that self hosts an OData WCF data service.

The host is of type DataServiceHost and is configured programmatically in code, not using the config file.

Connections to the service are via webHttpBinding which uses SSL and basic authentication. My service listens on port 1234.

When a client browses to https://localhost:1234$metadata they can gain access to the xml meta data for the service.

I want to prevent access to the metadata at the present time but can't work out how to disable it?

Does anyone know how to disable access to $metadata in the above scenario?

Answer 1

I finally found a way of doing this....

// Disable mex ($metadata)
ServiceMetadataBehavior smb = host.Description.Behaviors.Find<ServiceMetadataBehavior>();
if (smb == null)
{
    smb = new ServiceMetadataBehavior();
    smb.HttpsGetEnabled = false;
}
host.Description.Behaviors.Add(smb);

host.AddServiceEndpoint(ServiceMetadataBehavior.MexContractName, 
                MetadataExchangeBindings.CreateMexHttpsBinding(),
                "$metadata");

I played with setting the ServiceMetadataBehavior several times with no effect. The trick to getting HttpsGetEnabled = false to take effect is to create a metadata endpoint with the name "$metadata".

If you don't create a mex endpoint it seems the DataServiceHost just uses its own metadata endpoint and ignores your behaviour settings.

HTH