Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Let’s say you’ve got a WCF service that is accessible via HTTP and HTTPS, but you want only certain methods to be available with HTTPS– how can I check if the current request is HTTPS? Since HttpContext is empty, you can’t simply check HttpContext.Current.Request.IsSecureConnection — any other ideas? Thanks in advance.
Consider that WCF applications can also be hosted as a Windows service, with no ASP.NET at all, in which case there is no such thing as “secure” vs. “insecure.” That is one reason why WCF does not attempt to make this information available.
One option would be to run the WCF service in ASP.NET Compatibility Mode, where you do have access to the
HttpContext.Currentinstance.My choice, however, would simply be to create a different, SSL-only service for the secure operations. I really think you’d want to do this anyway, so the contract is explicit; otherwise you’re left doing runtime checks and clients may have no idea that the methods they’re trying to use aren’t allowed.
“Best practice” in a web service is to make these types of restrictions as explicit as possible, and having a separate service available only over SSL is by far the clearest means of describing your service’s restrictions.