Question

If i am hosting a WCF service so that someone(i.e someone whom i know) can consume my service, but what if someone else(i.e someone whom i don’t know) consumes it then would do i? How do i prevent that?How can this be achieved?

Can it be done through service throttling or what are the other ways of achieving this?

Answer 1

No, there’s no mechanism in WCF to allow certain clients from using your service while prohibiting others. You’ll need to approach this from a different angle.

One way is to not automatically publish your metadata from your service – e.g. make it almost “invisible” – and then distribute the necessary metadata information in the form of one or several WSDL and one or several XSD files to those clients you want to connect to your service. If your metadata is not available, someone just browsing to your service address will not get any information about what to call.

The metadata exchange is controlled by the <serviceMetadata> behavior, and by having a “mex” endpoint on your service. Remove both and your service is invisible.

The other way would be to prohibit any external users to access your WCF server based on firewalls and network rules. This cannot be done by WCF, but your network administrator could limit which IP’s have physical access to the machine where your WCF service runs.

Marc

UPDATE:
In order to ship metadata to those users who should be able to call your service, you can do one of two things:

1) Using svcutil.exe /t:metadata (path+name of your service assembly), you can extract the metadata from your service assembly (e.g. MyServiceLibrary.dll). This will give you one or several WSDL and one or several XSD files, which you need to ship to your intended users. They can put these files somewhere on their harddisk and then in the “Add Service Reference”, instead of entering the URL to discover the service, they can type in the name of the main WSDL (which imports all other files) and they’ll get their client proxy.

Or:

2) With the service up and running, you could “Add New Project” to your solution, choose a Class Library (MyService.Client), then do a “Add Service Reference” and enter your service URL. This will create all the necessary files and everything in your new class library. Compile this class library and ship that assembly MyService.Client.dll to the users you want to allow access to your service.

With both solutions, you don’t need to have metadata exchange enabled, and someone else cannot just walk up to your service and get all the information needed in order to call it.