How can I protect .NET Web Services against XXE exploits?
<p>I am trying to protect a .NET web service against <a href="https://www.owasp.org/index.php/XXE" rel="nofollow noreferrer">XXE</a> exploits.
For the underlying SOAP message is XML, it is potentially at risk.</p>

<p>A way to prohibit DTD processing for XML documents can be found <a href="https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#.NET_4.0_and_later" rel="nofollow noreferrer">here</a> and <a href="https://msdn.microsoft.com/en-us/magazine/ee335713.aspx" rel="nofollow noreferrer">here</a>. 
However, the XML parsing of the SOAP message is done by the framework. </p>

<p><strong>How can I modify the settings of the XML reader in order to turn off DTD processing?</strong></p>

<p>I also looked for a hook to access the XML content directly, but found nothing appropriate in the documentation of <a href="https://msdn.microsoft.com/de-de/library/system.web.services.webservice(v=vs.110).aspx" rel="nofollow noreferrer">WebService</a>.</p>