WCF security scenario

Question

Hi

I have a WCF service, and two apps behind the Firewall, and third app connect remotely through internet. I host the service on IIS.

If I restrict the IPs to local IP, and that remote server IP using IIS, would that be sufficient? if yes, Is that a bad idea for another reason rather than security.

Given that the remote server will connect through HTTPs and credentials.

thanks

Answer 1

Securing using IP is a good idea only if you are sure that IPs are static and unlikely to change. For example, local IPs can easily change (typically, they get auto assigned). So, I will go via this route if what you are securing is a critical/sensitive.