When going into a production environment, I discovered that WSE was throwing the following exception:
System.Web.Services.Protocols.SoapException: SOAP-Fault code:http://schemas.xmlsoap.org/ws/2004/08/addressing:DestinationUnreachable Message: Microsoft.Web.Services3.Addressing.AddressingFault: Destination Unreachable ---> System.Exception: WSE846: The <wsa:To> header must match the actor URI value of the web service. The actor URI value can be explicitly specified using SoapActorAttribute on the ASMX class. In the absence of the attribute, the actor URI is assumed to be equal to the HTTP Request Url of the incoming message. The <To> header received contained http://MySite/MyService.asmx while the receiver is expecting http://MySite/MyService.asmx?StuffAddedByProxyToQueryString. --- End of inner exception stack trace ---
The problem was that the firewall functions as a proxy server and adds some stuff to the query string of the request, making them not match. The packets were signed by the client with the base URL and the server received the URL that had been munged by the proxy server.
The solution was very simple, I added the following attribute:
to my service and it disabled that check. According to Zach Bonham, the same result should be expected when using a load-balanced web farm. He also observes “but it seems like I’ve lost some of the functionality of why I chose WSE in the first place,” and I definitely agree with that.