How to secure a WCF service to be consumed by a specific application only?

Question

Hi folks,

I have a specific Silverlight application, that is fed with data by a WCF-Service. I want to make sure, that the WCF-Service is only called by that specific Silverlight App. What is the best way to accomplish that and what do I have to do? It doesn't have to be a high security solution.

Thanks in advance, Frank

Answer 1

Enable basic authentication (username/password) on the service. Create a single user which the Silverlight app will use to authenticate itself with the service.

Easier, but less secure, might be to just use some sort of identifier (only known to the Silverlight client) as a service parameter.

Both options are obviously most secure when implemented with HTTPS. This can be accomplished by using a server certificate.

Answer 2

You CANNOT restrict access to such a service. Your app will need access to whatever key/password you chose. It is trivial to decompile your app and extract the key. SSL/TLS will not help - because the password can be extracted from the compiled code.

This question has been asked quite a few times recently -

1. http://stackoverflow.com/questions/2616797/ensure-exclusive-access-to-webservice
2. http://stackoverflow.com/questions/2578645/how-to-restrict-access-to-my-web-service
3. http://stackoverflow.com/questions/2601805/how-can-i-create-and-use-a-web-service-in-public-but-still-restrict-its-use-to-on

Answer 3

If your application is running anonymously then it's virtually impossible to be 100% secure.

How ever if your are requiring your users to authenticate then you should be able to make the service relatively secure by requiring their login credentials...

Answer 4

I don't know if it easy with WCF, but I guess you could do something using client certificates. I only used this approach for protecting websites and it was quite easy to do...