Question

This question was inspired by Jon Skeet’s question here where he asked about people pain points with LINQ so I hope this question isn’t out of place …

Version 4 of WCF tackled, probably, one of the areas where many people struggled with WCF – namely configuration. However, from this tagged set of questions and other forums there are obviously other areas that people struggle with.

I’ve made a bunch of blog posts and screencasts in the past trying to focus on common issues (such as duplex, sessions, etc). I’m planning another set but want to focus on things that are causing people problems even with the changes in version 4.0.

Areas I see are things like

• Instancing and Threading
• Security
• REST support
• WCF and Silverlight
• Large message processing / streaming
• Configuration (still)
• Serialization

And I’m sure there are more, so I’d like to get input and maybe we can make sure that the product team also get some feedback to the greatest pain points people have with WCF

Answer 1

I sometimes participate both here and on MSDN and after answering many questions my opinion is that the greatest pains people have are:

Configuration

Configuration is a pain even more then before. Simplified configuration makes a lot of things even worse because before this simplification if you made mistake in the configuration you got an exception. Today you will make typo in your service name (or you will forgot to add namespace) and your service will silently use another configuration.

Security

Security is a paint, it was a pain and it will be a pain.

• Security itself is complicated and WCF is making this more blured because where programmers on other platforms use shared vocabulary based on real WS standards, WCF uses its own names.
• Only subset of security standards implemented – one failure is missing UserName token profile with digested password directly in WCF.
• When hosting services in IIS security features in services are completely shared with IIS and restricts settings for the whole site / virtual directory.
• When hosting services in IIS basic authentication is handled in IIS – you must build custom module to handle it differently (but if you use self hosting you can use custom user name password validator in WCF directly – IIS should support that as well).
• Bad support for generating security configuration when creating proxy from WSDL. Currently the best what WCF has is custom binding. Custom binding on client side is useful only when service is also WCF and uses custom binding. We need better support in security binding element to provide same configuration features as its counterpart in code. Then the WSDL importer should be able to use new binding element and create proxies for secured services. Once such importer is not able to import WSDL we will be sure that default WCF doesn’t support security requirements expected by the service.

REST

Still a lot of people don’t see difference between REST and SOAP and the most common mistake is adding service reference to REST service. Also problem of the REST is that it was added to unified protocol independent API but REST is heavy protocol dependent and is not message oriented. This will be hopefully improved in Web-API.

Protocols

It looks like new protocols or protocols versions are not added to WCF.

Extensibility

WCF has great extensibility unless you are trying to extend existing feature. If you decide to extend existing implementation you usually can’t. For example to add mentioned UserName token profile with digested password you must do it completely from the scratch. You cannot extend existing user name implementation.

Edit: Last two are my personal pains.