/// <summary>
///     Retrieves a dataset containing up to maxQty items that fullfill a 
///     Topic search.
///     <param name="userName">User name for logon.</param>
///     <param name="password">Password for logon.</param>
///     <param name="topicName">Specifies the topic to search for.</param>
///     <param name="maxQty">The maximum number of items to return.</param>
///     <retvalue>
///         A dataset containing up to maxQty items that Fulfill the a Topic 
///         search or a minimal dataset containing error information.
///     </retvalue>
/// </summary>
[WebMethod()]
public DataSet GetBooksByTopicSecure(String userName, String password, String topicName, int maxQty)
{
    ExportData exportData = new ExportData();
    exportData.InitContract();
        
    DataRow contractRow = exportData.Tables[ExportData.CONTRACT_TABLE].Rows[ 0 ];


    try
    {
        SHA1 sha1 = SHA1.Create();
        byte [] bytePassword = sha1.ComputeHash(Encoding.Unicode.GetBytes(password));

        // logon
        CustomerData customer = (new CustomerSystem()).GetCustomerByEmail(userName, bytePassword);

        if (customer == null)
        {
            contractRow[ExportData.ERROR_FIELD] = "Invalid userName/password";
        }
        else
      {
            //get the book data            
            GetBookData(exportData, topicName, maxQty);
        }
   }
   catch
   {
        //return error 
      contractRow[ExportData.ERROR_FIELD] = "Service unavailable";
   }
    
    exportData.AcceptChanges();
   return exportData;
    
    
}

This security problem can be resolved by adding a <webServices> section to the web.config file: 

<configuration>
...
<system.web>
...
        <webServices>
            <protocols>
              <remove name="HttpGet"/> 
            </protocols>
        </webServices>