WCF Security question?

Question

I have some collegues who have build a WCF Service. Their security settings are the following:

security mode="None" transport clientCredentialType="Windows" proxyCredentialType="None" realm="" message clientCredentialType="Windows" negotiateServiceCredential="true"
establishSecurityContext="true" security

Does it makes sense to specify the securiyt mode="None" and then specify transport/message security underneath?

Grtz P.

Answer 1

This is just basically NO SECURITY at all - that doesn't make any sense at all - except for maybe development time :-)

If you have <security mode="None"> then anything you specify below is not taken into account - you could leave that out just as well.

Marc

Answer 2

It does no harm, the mode="None" value means none of the individual settings for either message or transport will be used.