Passing private data through a WCF OperationContract method?

Question

Assume I have a method in my WCF Service implementation called Login and it is defined as follows:

[OperationContract]
[WebGet(UriTemplate="login/{username}/{password}")]
bool Login(string username, string password);

Obviously, passing something like http://localhost:80/login/user1/pass1 is not very secure, so how is the is normally handled in a wcf rest scenario?

Answer 1

One option would be to run your whole site as SSL.

The other as you mention is to send the user name and password in a POST.

Is there a requirement that is forcing you to do this in JS?

Answer 2

The other option would be to do some client side encryption, where the user and password are encrypted via javascript, converted to base64, then called the way you have shown in your code.

This is obviously less safe, because if an attacker knows how you are doing your encryption (by examining your javascript code), then he has a leg up on breaking your encryption. But this, combined with SSL, might be a viable solution for you depending on the sensitivity of your site.