wcf: adding username to the message header is this secure?

Question

I'm connecting to a WCF service in an ASP.NET app. I'm logging in using one username and password and passing the actual username of whoevever is logged into the ASP.NET web app in a message header as below.

  using (OperationContextScope scope = new OperationContextScope(myService2.InnerChannel))
  {
    Guid myToken = Guid.NewGuid();

    MessageHeader<string> messageHeader = new MessageHeader<string>(HttpContext.Current.User.Identity.Name);
    MessageHeader untyped = messageHeader.GetUntypedHeader("token", "ns");

    OperationContext.Current.OutgoingMessageHeaders.Add(untyped);

    lblResult.Text = myService2.GetData(1231);
  }

I'm also using a service certificate as below

      <serviceCredentials>
        <serviceCertificate findValue="CN=tempCert" />
        <userNameAuthentication userNamePasswordValidationMode="MembershipProvider"
          membershipProviderName="MySqlMembershipProvider" />
      </serviceCredentials>

What I'm worried about is whether this sufficient protection to stop people getting at the username stored in the message header?

ASP.NET config is

    <system.serviceModel>
 <behaviors>
  <endpointBehaviors>
   <behavior name="NewBehavior">
    <clientCredentials>
     <serviceCertificate>
      <authentication revocationMode="NoCheck"/>
     </serviceCertificate>
    </clientCredentials>
   </behavior>
  </endpointBehaviors>
 </behaviors>
 <bindings>
  <wsHttpBinding>
   <binding name="wsHttpEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384"/>
    <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false"/>
    <security mode="Message">
     <transport clientCredentialType="Windows" proxyCredentialType="None" realm=""/>
     <message clientCredentialType="UserName" negotiateServiceCredential="true" algorithmSuite="Default" establishSecurityContext="true"/>
    </security>
   </binding>
  </wsHttpBinding>
 </bindings>
 <client>
  <endpoint address="http://localhost/WCFTestService/Service.svc" behaviorConfiguration="NewBehavior" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpoint" contract="WCFTestService.IService" name="wsHttpEndpoint">
   <identity>
    <certificate encodedValue=""/>
   </identity>
  </endpoint>
 </client>
</system.serviceModel>

and at the service side its

  <system.serviceModel>
<bindings>
  <wsHttpBinding>
    <binding name="wsHttpEndpointBinding">
      <security>
        <message clientCredentialType="UserName" />
      </security>
    </binding>
  </wsHttpBinding>
</bindings>
<services>
  <service behaviorConfiguration="ServiceBehavior" name="Service">
    <endpoint address="" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpointBinding"
      name="wsHttpEndpoint" contract="IService">
      <!--<identity>
        <dns value="" />
      </identity>-->
    </endpoint>
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="ServiceBehavior">
      <serviceMetadata httpGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="false" />
      <serviceCredentials>
        <serviceCertificate findValue="CN=tempCert" />
        <userNameAuthentication userNamePasswordValidationMode="MembershipProvider"
          membershipProviderName="MySqlMembershipProvider" />
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>

Answer 1

The big question is: do you have any kind of transport-level or message-level security enabled on your binding? What binding are you using?

If you have transport-level security (typically through using HTTPS over SSL), then you have a point-to-point encrypted transport channel which I would deem very safe.

If you have message-level security using a certificate on the client, too, and you do encrypt the whole message, then you should be safe, too.

It really boils down to what binding you're using and what security settings you're using on that binding. Show us the server's config !

Marc