WCF and AIR/Flex 4 security

Question

Dear All!

In a current project we are hosting a WCF 3.5 service on IIS7 and expose the methods through basicHttpBinding to an Adobe AIR/Flex4-client. Luckily Flash Builder 4 has integrated support for SOAP, so that a service-proxy can be generated easily.

Unfortunately, we are not able to find any elegant solution to enable username authentication. The only way we got working, is to pass username und password on every single method-call, which certainly blows up the method-signatures and enforces the service-method-implementation to do a validation by their own.

Could you please direct me to any solution, which could bring username authentication within the message-headers to adobe flex?

Best regards, Daniel Lang

Answer 1

How would you pass the authentication credentials in a non Flex app?

Most people just set a cookie of some sorts. Many server side app servers do this stuff internally.

Any calls from the Flash Player to your backend will send along any cookies that were already sent; which can easily be used to connect to your server side session. I thought most server side app servers handle this stuff internally.

If you need to set specific headers to HTML calls, you can specify them using the headers property of HTTPService. Here is a good example about how to set the header.