ansaurus

Question

Create a secure application with basicHttpBinding

Answer 1

+2 A:

basicHttpBinding is - as its name implies - very basic in what it offers. It's especially basic when it comes to security.

As far as I know, you cannot achieve what you're trying to do. BasicHttpBinding only supports transport security (using https protocol) with Windows credentials (not suitable over Internet with custom users) or digital certificates, or message security by means of a digital certificate (which you explicitly rule out - why??).

Check this CodeProject article 8 steps to enable windows authentication on WCF BasicHttpBinding or Google for "basicHttpBinding security" - you'll find lots of articles, but probably no real solution for your requirements - you just cannot do this with basicHttpBinding.

Update: by default in WCF, you should pass the caller's credentials with every call - but not as parameters on the service method, but instead by specifying the client credentials on the service proxy generated client-side. Something like:

 myService.ClientCredentials.UserName.UserName = "username";
 myService.ClientCredentials.UserName.Password = "p@ssw0rd";

marc_s 2010-06-27 08:48:46

Thanks a lot, marc_s!

Trần Quốc Bình 2010-06-27 13:29:54

One more question, pls. I want to build a silverlight application which allows user to login using WCF service (usernames and passwords are stored in database). Is it possible?

Trần Quốc Bình 2010-07-06 01:47:06

WCF services are (and should be) by nature stateless, e.g. you don't "login" and then use additional services. You provide your credentials with every call.

marc_s 2010-07-06 05:35:29

Thanks for reply, it means that WCF service required username and password for every call --> like this: "string getData(string username, string password, string keyword_to_get_data)" ??? :|

Trần Quốc Bình 2010-07-07 04:45:17

No, not really - you would pass the username/password as the client credentials in the header. You don't need to up them as parameters into your service calls.

marc_s 2010-07-07 05:33:56

And how to get username and password at server side (without using wsHttpBinding because silverlight only supports basicHttpBinding and netTCPBinding)?

Trần Quốc Bình 2010-07-07 06:23:03

You don't have to "get" those on the server side - the server side will be configured to validate those against e.g. ASP.NET membership database

marc_s 2010-07-07 06:49:39

Can you give me an example. Anyway, thank you very much. :)P/S: I am using wsHttpBinding with a custom username validator. But it makes me confuse when trying to use basicHttpBinding.

Trần Quốc Bình 2010-07-07 06:58:12

ansaurus

tags:

views:

answers:

Create a secure application with basicHttpBinding

related questions