Home/ Questions/Q 9131689
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T08:10:52+00:00

Secure webservices in WCF Background We want to create a secure WCF service that

  • 0

Secure webservices in WCF

Background

  • We want to create a secure WCF service that has does encryption/decryption of data. The nature of data that will be encrypted and decrypted requires the highest level of security possible.
  • Consumers of this service will be applications within our network. The will be asp.net websites, other wcf services, console applications and possibly java based applications running on linux
  • Consumers will be running on local computer accounts that dont have any domain membership.

I have done a lot of reading about wcf security and do understand the concepts to a large extent. I am looking for a reference architecture that has worked well for others with similar needs.

Question

  1. What authentication method should i use given that the new wcf service cannot depend on any database etc to store credentials, and also cannot depend of consumers to be members of a windows domain. I should be able to identify the consumer correctly within the service because the functionality will change slightly depending on who is the consumer.
  2. What type of transfer security should i use- transport/message/mixed? Do any of these have performance considerations?
  3. What else should i be thinking about?
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team
    1. Use client certificates for authentication. To identify a customer use message contracts with a custom header. Each client should put some unique value into the header.
    2. I suggest using transport security in your case. There are two main drawbacks of using message security: Performance and which is more important to you Interoperability as you said you may need to support Java clients. You said you already read a lot about WCF security but just in case you missed it, here is a good article on Transport and Message security.
    3. Pay attention to your service binding. I suggest using basicHttpBinding taking into account possible Java clients.

    Hope it helps!

    EDITED:
    The header value should be a private one. Only you and your client should know about it. It’s like what if I know your Gmail password, it will not take long to find out your login.
    If you don’t think it is secure enough you may skip custom header and map each client to an IP or a set of IPs. For example, IP 12.32.456.10 corresponds to client A. Then you can store this mappings in custom config file section and you can encrypt this section so that even people who has access to your service files can’t get the mappings.

    Don’t forget to mark the answer as helpful if it is 😉

    • 0