Question

I have my WCF working. I have the following configuration for it:

<bindings>
  <basicHttpBinding>
      <binding name="HttpStreaming" maxReceivedMessageSize="65536000" closeTimeout="00:05:00" bypassProxyOnLocal="true" openTimeout="00:05:00" receiveTimeout="00:30:00" sendTimeout="00:30:00" transferMode="Streamed" messageEncoding="Mtom">
        <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="65536000" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
        <security mode="None">
          <transport clientCredentialType="None" proxyCredentialType="None" realm="" />
        </security>
      </binding>
  </basicHttpBinding>
</bindings>

<behaviors>
  <serviceBehaviors>
    <behavior name="CifsManager.CifsManagerServiceBehavior">
      <serviceMetadata httpGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="true" />
    </behavior>
  </serviceBehaviors>
</behaviors>

<services>
  <service behaviorConfiguration="CifsManager.CifsManagerServiceBehavior" name="CifsManager.CifsManagerService">
    <endpoint address="" binding="basicHttpBinding" bindingConfiguration="HttpStreaming" contract="CifsManager.ICifsManagerService"></endpoint>
  </service>
</services>

I generated the proxy class for calling the service ServiceClient and I call it in the following way:

var service = new ServiceClient();
service.ClientCredentials.UserName.UserName = "111";
service.ClientCredentials.UserName.Password = "111";
service.bufferSize = int.Parse(ConfigurationManager.AppSettings["BufferSize"]);
var file= service.GetFile();

Here I found the articles where it is described how to solve my problem throught the wsHttpBinding, but using it I get the server error. Could I create the authentication using the basicHttpBinding or I need the wsHttpBinding and how should I do it?

Answer 1

I’m just going to condense all of this into an answer so it’s all in one place and easier to find instead of spread out amidst comments. Using BasicHttpBinding means that your credentials will be passed in plaintext over the wire, meaning they could be intercepted along the way without much trouble. You can avoid this problem by using WsHttpBinding, which allows you to use one of three different security types: Transport, Message, or TransportWithMessageCredential. You can read about these here. Keep in mind, however, that with any of these you’ll have to have a certificate of one form or another.

This question has a brief discussion of some other WCF security options. If you’re dead set on using BasicHttpBinding and passing your credentials over the wire, you could at least consider masking them somehow before doing so, perhaps an sha1 with a salt or something similar. If you don’t want to use any of the built-in and done solutions that are available like ASP.NET Membership, you’ll have to figure out on your own what kind of an auth token you want to pass back and forth.