Question

I have a client app that makes calls to a WCF service. This app is on a public computer that’s easily accessible and anyone can easily copy the .EXE and .CONFIG of my app into another machine and start using it.

Is there a pattern where I can check if the request is coming only from an app on a computer I installed it on and not on one it has been copied to?

Thanks in advance.

EDIT: I have thought of using the MAC address of the computer but not sure how reliable/easily hacked that would be. This is a financial product so the authentication needs to be very very tight.

Answer 1

You could e.g. define a list of valid IP addresses where you installed your stuff on, and then apply a IP filter to only allow calls from those authorized IP’s.

See:

• WCF Behavior Example – IPFilter
• Detect client IP in WCF 3.5