XBAP Connectivity and Web Services

Posted on: April 12, 2007

This post is going to explain, in simple terms, how to build an XBAP that needs to access data (in this case XML) over a network. It is also going to talk about how to communicate with a Web Service from within an XBAP. All this while avoiding the WebPermission exception AND the Environment exception. :) And no, we won’t be going full-trust.

As always, some things are simplified for the sake of clarity, if you feel there is something you’d like me to explain in more detail, please drop a comment.

Let’s get to it. First a list of truths (as of 2007/04/12):

  • An XBAP cannot communicate with a WCF Web Service*
  • An XBAP cannot access local resources on the users machine**
  • An XBAP cannot access arbitrary online resources***
  • An XBAP is very sensitive about its Site Of Origin
  • * – As of now, however, rumors say that with the release of .NET 3.5, this might be made possible, within certain security limitations.
  • ** – Unless the application is installed and running with modified security settings. By default an XBAP lives in the security sandbox of the Internet Zone.
  • *** – For example, you can set an Image control to Source an image from an off-site url, but you cannot (by default) access an XML stream from an arbitrary URL, via for example an XmlDocument.Load().

So with that out of the way, how do you go about connecting your XBAP to a webservice? Well it turns out that you can actually communicate to non-WCF webservices, and in the world of .NET that means ASP.NET (asmx) services.

This fact has lead some to suggest the technique of Bridging, but what does that mean? Well, say that you have a set of nice WCF services, or for that matter services that do not reside on the same physical machine / domain as your XBAP. In that case, what you do is you build an ASP.NET service that exposes methods to go get the data from these other services and pass it back down to you, thus acting as a bridge between your XBAP and the rest of the world.

How is this possible if an XBAP cannot access arbitrary online resources? Well it turns out that an XBAP can actually communicate with one and only one point outside its protective little bubble, without security getting in your way so to speak :), and that is that magical place called the Site of Origin. The following illustrations should clarify somewhat:

Xbap data flow

This needs to be explicitly enabled in the security settings for you project.

(In VS2005, right click your project in the Solution Explorer and select Properties, click the Security tab, the Advanced button and then make sure the “Grant the application access to its site of origin.” check-box is checked. Also why you are there, it helps to fill out the “Debug this application as yada yada” textbox with a domain/machine name that makes sense to you. I will explain why later.)

Now that you have that out of the way, two things become possible. First of all you can access webservices hosted on the same site, and even better you can now reference resource-uris that reside on this domain.

So say for example that you have an XML file sitting on the same webserver as the one hosting the XBAP, and you’ve granted the application access to its site of origin. This means you can do the following inside your XBAP:

using System.XML;
	XmlDocument D = new XmlDocument();
	//Do something with your XML...

Not too bad :). Be warned however that the domain/machine name part of the site of origin must be the same as the one you set in the security settings. This can lead to some confusion during debug when for example you might have set the site of origin to ‘http://machinename’ but in your project you might refer to the ‘http://localhost’. This will not work!

This also means that in some scenarios you can switch out your bridging ASP.NET webservice for a Windows Service that serves up XML data to the webserver that you application can download, thus avoiding the need to open up and secure a web service.

This whole site of origin thing is very important for another reason as well. Say that you are developing and testing an ASP.NET web service on the same machine, and that you deploy it on your local IIS (I’m talking about IIS6 by the way). If you then go ahead and reference that service in your XBAP project, you need to take note so that the url by which you refer to it is the exact same as your site of origin.

Don’t let the machinename/localhost similarity fool you, the Url’s that get added to you Service.wsdl file need to be exactly the same as the ones you specified as the Site of Origin.

Ok, I’ll stop here for now. More on the deployment of ASP.NET services and XBAPs in another post.


15 Responses to "XBAP Connectivity and Web Services"

Yes, one should never accuse you of not covering a large spectrum of subjects on your blog.

To further up the tech-related statistics, I’d like to post a link that I stumbled across yesterday when checking my current google status (hey, don’t everyone?):


It feels so, so far away in time… but that was 2004! Kind of stunned me. I’m still very interested in actually building the software we discussed back then.

wow, nice handling of long url:s!


hahaha. That was a blast back in LA. So funny with the whole Radio thing as well. It seems I’ll be hanging out at Siggraph every two years or so, 2002, 2004, 2006. So I guess my next visit should be in 2008. Maybe we should try to put something together again??? :)

Thanks very much for this post, haven’t had a chance to try it out yet but if this ‘gets me out of the sandbox’ I will be very much appreciative. At the moment XBAP seems to have so much potential but is really stunted by its isolation.

My pleasure :). I agree that XBAP’s are still a bit immature as a delivery vehicle, but we have to keep in mind that it’s a version 1 technology, and I think it’s safe to say that over the next few iterations it will mature. Also, we as developers might not yet have figured out the right scenarios for it.

If there is anything else I can help you with or if you find any errors in the posting please let me know :).

hi can u post a simple sample where xbap calls and uses a webservices

hmm I’ll see what I can do, a little bit busy right now though so give me a moment…

I really suck I know ;) I wish I had more time to blog and write samples like the one asked for above, trust me I really enjoy spreading the joy of .Net, but for the moment work and my personal life is really just taking up all my time, and frankly that’s where I have to and want to give priority. I haven’t forgotten about thi sample though and I hope I’ll be able to put something together soon!

I would like to see a continuation of the topic

[…] to integrate external data into WPF Browser Applications: click here to read an interesting article. « Installing Windows XP from […]


Thank you for a very informative post. But allow me to ask you this:

First: I understood from you (and correct me if I’m wrong) that my xbap app and my web service have to be under the same web-site (not just on the same machine) so say my xbap is a virtual dircetory: http://mymachine/mySite/abc.xbap than the web-service would have to be under the same url, is that correct? Assuming it it correct I’ll move on to my problem: my web service is actually makeing a call to a third party assebly that won’t allow partial trust, so if i have to put the web service in the same project, it means I also have to reference the 3rd party assembly, which results in an error: “That assembly does not allow partially trusted callers” . I was hoping that there is way to separate the web-service from the xbap app so that they reside in different website (or virtual directory) so that it can run in different zones (the web service can run in full trust) but when I try that I get that lovely WebPermission exception that we are all familiar with.

To your first question, unfortunately when confirming the site-of-origin no attempt is made to resolve the domain to the underlying IP. Thus even though you might have the service and the XBAP running under the same physical IP, if the domain is different you will get the WebPermission exception.

Also, since port number is included in the site-of-origin that means you cannot bind the site-of-origin to the physical IP+path since you can only bind one website to each port. (Since you have to include the port in the path they will ultimately be different == WP Exception)

So as you see, even if the domain was resolved to its IP, since port number is part of the site-of-origin this still wouldn’t help us.

As for your scenario, even though it might seem a bit cumbersome, how about adding a bridging tiny service to your site that makes a call to the service communicating with the third party assembly? It’s far-fetched maybe but it means all you have to do in your site-included service is kickstart the other service and wait for it ti return its result (data)… Or am I misunderstanding your scenario?

Please let me know if this does not answer your question.


It’s finally working now. What finally did it was that I opened app.config and replaced localhost with my web site name, exactly the type of issue you where describing in your article. So now it’s working and I’m happy:). So thanks a lot for your help I would have never be able to get here without your very informative article.


Always glad to help! :)
Thank you for the feedback!

It appears you can call WCF web services now, which I guess makes things easier. My problem is I still don’t know enough about WCF to really make any use of it. I was wondering if you could put together a sample that calls an external API such as Live search and returns a users search to them. That would explain how to make actual use of an XBAP in my opinion. Either REST or SOAP it doesn’t matter that much as long as I can interact with an external API. Thanks for writing this really informative post!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s


This blog has no clear focus. It has a focus though, it's just not very clear at the moment...

Dev Env.

Visual Studio 2008 Prof / NUnit / Gallio / csUnit / STools (ExactMagic) / doxygen / dxCore / TypeMock / TestDriven.net / SequenceViz / CLRProfiler / Snoop / Reflector / Mole / FxCop / Subversion / TortoiseSVN / SlikSVN / CruiseControl.net / msbuild / nant

Blog Stats

  • 81,636 hits