Folks,
We are developing an application that is part a downloadable WinForms application that connects to a set of Azure-hosted WCF services.
Our main issue now is how to properly secure these services to prevent DoS attacks and other security issues.
The WinForms applications will be installed on end users PCs anywhere in the world (they will be able to download this from our website) so we have no control of what the end users does to our application.
We have already secured the application as much as possible but we know nothing is unbreakable. Our main goal now is to make sure methods of these web services are only called by our application and that we can defend ourselves against attacks.
We found a best practice white paper from Microsoft stating that for some scenarios we have we could use the GateKeeper scenario (like for storage). We do not have selected anything yet for our queues.
Another issue is how to best control authentication from our WinForms app to the services in the cloud.
Has anybody here developed or worked on any similar projects and would like to share some ideas?
Cheers,
This question has already been asked again and again. If a web service is hosted on any server which has a public IP, the only way you can block the client is to authenticate them first and if authentication goes well, they can use the method and if failed they can not use. Authentication and authorization is the key for any service which is hosted on internet otherwise keep the service private.
And to authenticate a WCF service there are pattern & practices are already available and it seems you have already taken care of that.