Programming WCF Services, 3rd Edition

Internet Application Scenario

In the Internet scenario, the clients or services may not be using WCF, or even Windows. If you are writing an Internet service or client, you cannot assume the use of WCF on the other end. In addition, an Internet application typically has a relatively large number of clients calling the service. These client calls originate from outside the firewall. You need to rely on HTTP for transport, and multiple intermediaries are possible. In an Internet application, you typically do not want to use Windows accounts and groups for credentials; instead, the application needs to access some custom credentials store. That said, you could still be using Windows security, as demonstrated later.

Securing the Internet Bindings

In an Internet application, you must use Message security for the transfer security mode to provide for end-to-end security across all intermediaries. The client should provide credentials in the form of a username and password, as this is a safe, low common denominator that all platforms support. For the Internet scenario, you should use the WSHttpBinding. You cannot use the basic binding because it does not provide for username credentials over Message security. In addition, if you have an intranet application that uses the NetTcpBinding but you do not wish to use Windows security for user accounts and groups, you should follow the same configuration as with the WS-based binding. This is done uniformly across these bindings by selecting MessageCredentialType.Username ...