Home/ Questions/Q 7532373
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-30T05:25:59+00:00

I need to create a web service to collect data from my customer’s applications.

  • 0

I need to create a web service to collect data from my customer’s applications.

Those applications are programmed with different technologies and they all have one thing in common: they can consume plain SOAP Web Service.

I already have a WCF Service that could be exposed but as it was built for internal purpose only, I never had to secure it.

I did read a lot of articles on how to secure WCF service and how to consume it from a Microsoft client application. However, I’m really concern about the customer’s non-microsoft applications abilities to implement a standard WCF Service security. I must keep in mind that some of them might be stateless and unable to hold on to a session or anything that might be required by a secure WCF Service.

So here are the options I have right now.

1) Add username/password parameters to each WCF function and perform a credential check on every call. (I do have an SSL certificate… is it enough to consider this option as secured?)

2) Drop my WCF Service and create a plain SOAP Web Service with username/password parameters as mentioned in option #1 to be closer to my customer’s applications capabilities.

3) Implement standard WCF security and let the customers find a way to deal with it on their own. (The real question here: is WCF security simple enough to be implemented by any SOAP client?)

4) Change my name and move to Jamaica with my customer’s money before they find out that I’m a Web Service security noob.

5) Something else…

So what is the my best option here?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Yes, I can offer the option we use. It sounds like you want basicHttpBinding.

    We have a WCF web service using basicHttpBinding and set IIS to use basic http authentication.

    Therefore non-.NET clients can consume it easily (basicHttpBinding) and we can give them an Active Directory domain account that allows them access via IIS. No usernames / passwords to constantly send back and forth through the web service and it runs over HTTPS for security.

    It’s currently being consumed by PHP, Java and .NET clients. Yes, .NET clients can still import this as a service reference which makes thing like trapping FaultExceptions easier.

    No solution is perfect for everyone but works great for our needs.

    • 0