WCF over SSL from non-secure page

Question

I have a WCF service that I need to run over SSL, I am calling it from a webpage (using jQuery) which may or may not be a secure page. The problem is, if I make the call from a secure webpage on my site, the call runs exactly how I would expect...however, if I make the call from a non-secure page on my site, to the secure web service (using "https://" ;) ) it returns null data (via Firebug). Anything I'm missing? Is this even possible?

Here is the configuration of the service I'm calling (I'm more than happy to provide more stuff if needed):

<behaviors>
  <endpointBehaviors>
    <behavior name="AspNetAjaxBehavior">
      <webHttp/>
    </behavior>
  </endpointBehaviors>
</behaviors>
<services>
  <service name="ClientServices.Membership" behaviorConfiguration="ServiceGatewayBehavior">
    <endpoint address="" behaviorConfiguration="AspNetAjaxBehavior" bindingConfiguration="SecureBinding"
     binding="webHttpBinding" contract="ClientServices.Membership" />
  </service>
</services>
<bindings>
  <webHttpBinding>
    <binding name="SecureBinding">
      <security mode="Transport"/>
    </binding>
  </webHttpBinding>
</bindings>

Here is the code that calls the service:

$.ajax({
            url: serviceUrl,
            type: "POST",
            contentType: "application/json; charset=utf-8",
            dataType: "json",
            data: '{"review":{"Username":"' + username + '"}}',
            success: function (data) {
                $.log(data);
            },
            error: function (a, b, c) {
                $.log(b);
            },
            cache: false
        });

UPDATE

If I change the service call method to "GET" and call it directly over SSL it works fine and outputs the jSon that I would expect. It's only inside the non-secure page where the problem persists.

Answer 1

There are ways around it, but "out-of-the-box" WCF does not allow sending passwords over unsecured transports, so the membership service won't be bound to the unprotected transport - thus the empty response.

(Ideally, the membership service should throw an exception to that effect if it wanted to be useful, but it would appear that that was overlooked.)

Answer 2

Assuming both site and service are both at yourdomain.com, then my first thoughts would be that when on the non-secure page, your browser is not attaching the cookie it has for the site domain and so when it calls the service, it isn't authenticated.

Have you used Fiddler to look at the raw HTTP header data and more importantly, what differs in this data when on the working and not-working page?

Luke