Question

I have an ASP.NET MVC 2 application in development that uses a web service to access security information (Roles, Permissions, etc). The users of these applications will be internal Company users. This web service security mode is currently set to “None”.

What kind of web service security do you recommend for my situation? Should I use certificates?

Answer 1

For an internal use I suggest using Windows Authentication :

<system.web>
  <authentication mode="Windows" />
</system.web>