Common Security Solutions for WCF (1)

Insecure Internet clients and services

The following illustration demonstrates a common and insecure Windows Communication Foundation (WCF) client and service example.

Features	Description
Security Mode	None
Transmission	HTTP
Bind	Use the BasicHttpBinding element in the Code or the <basicHttpBinding> element in the configuration.
Interoperability	Interoperability with existing Web service clients and services
Authentication	None
Integrity	None
Confidentiality	None

Service

The following code and configuration will run independently. Perform one of the following operations:

• Use code instead of configuration to create an independent service.
• Use the provided configuration to create the service, but do not define any endpoints.

Code

The following code demonstrates how to create an insecure endpoint. By default,BasicHttpBindingSet the security mode to None.

Service configuration

The following code uses the configuration to set the same endpoint.

<?xml version="1.0" encoding="utf-8"?><configuration>  <system.serviceModel>    <behaviors />    <services>      <service behaviorConfiguration="" name="ServiceModel.Calculator">        <endpoint address="http://localhost/Calculator"                   binding="basicHttpBinding"                  bindingConfiguration="Basic_Unsecured"                   name="BasicHttp_ICalculator"                  contract="ServiceModel.ICalculator" />      </service>    </services>    <bindings>      <basicHttpBinding>        <binding name="Basic_Unsecured" />      </basicHttpBinding>    </bindings>    <client />  </system.serviceModel></configuration>

Client

The following code and configuration will run independently. Perform one of the following operations:

• Use Code (and client code) to create an independent client.
• Create a client that does not define any endpoints. Use the client constructor that uses the configuration name as the parameter. For example:

Code

The following code demonstrates a basic WCF client that accesses an insecure endpoint.

Client Configuration

The following code configures the client.

<?xml version="1.0" encoding="utf-8"?><configuration>  <system.serviceModel>    <bindings>      <basicHttpBinding>        <binding name="BasicHttpBinding_ICalculator" >          <security mode="None">          </security>        </binding>      </basicHttpBinding>    </bindings>    <client>      <endpoint address="http://localhost/Calculator/Unsecured"          binding="basicHttpBinding"           bindingConfiguration="BasicHttpBinding_ICalculator"          contract="ICalculator"           name="BasicHttpBinding_ICalculator" />    </client>  </system.serviceModel></configuration>