Please advise me on this.
I have both Wcf service (which will be responsible for highly secured data manipulations) and Web App in same Server and i will access this Web application (Which will consume this Wcf service for data manipulation) over internet.
1) Is this a good practice to have both in same server.
2) What WCF Security i have to choose either Transport or Message security.
3) What type of architecture i have to use (Eg: 3 tier or N- Tier)
I use VS2010 and .Net framework 4.0 and Sql Server 2008 for development.
Thanks in advance.
It is not a simple question to answer if it is a good practice to have the WCF service on the same server as the app. If you want ot shield the service as much as possible you could of course put it on a separate server behind the firewall only allowing the web app to access it. But then it does sound somewhat superfluous to create a service at all. Does it provide methods that should be accessible to a client? — When determining the deployment scenario you also have to measure cost to security and scalability. More servers means higher costs both for buying the servers and for maintaining them.
I think you can use both transport and message security, but using message security you could transfer the messages on http, which means less traffic than https.
About the number of levels in your application, this also depends on the nature of the application. You might even consider CQRS or similar architectures. But if you have proper segregation of the layers and they only depend on the next layer you can always insert new layers if needed. Speaking of which: If you plan to use the WCF service as an internal DAL, you could also prioritize to just create a simple DAL with a proper interface, which could later be changed to a WCF service.
There are many good reasons for creating a web service and it gives you the opportunity of scaling on more servers later on, so I am definately not recommending against a web service, just saying that it might be overkill or introduce a larger attack surface in your application.
Performance wise you might get a boost by using tcp bindings rather than http, but connecting external applications is easier on http if some non wcf client is involved.
Perhaps this post contains more questions than answers, but you are the only one who can decide given the brevity of your description 🙂