Secure WCF service and Methods

Question

I have created a WCF service in our Project. There are many methods inside this. Now its opened. That means anyone form outside can create a proxy of our service and could easily use our methods. How to secure this thing. I used BasicHttpbinding and read on the Certificate security. But not able to make secure. Please guide me. Its urgent. I cannot change the basicHttpBindings. So give me a solution to protect my service

Hemant Srivastava · Answer

Expose meta data end point and set httpgetEnabled property = true until you set your proxy locally for your unit testing/developement. Once you created proxy then remove that metadata endpoint. You can still work with your already generated proxy (even meta data endpoint is not there!) but outside world can not generate proxy. I am sure this could help you. If it works for you please mark it accepted answer so that others can benefit with this discussion.

Saikat Malakar · Answer

Dear Hemant Thank you very much for your help. But unfortunately i cannot disable the httGetEnabled property in my web config. I am using the proxy in my project itself. so please tell me is there any other way to secure the methods. Its urgent. And please notice that i am using the basicHttpbinding and i cannnot change it.

Saikat Malakar · Answer

Dear tri_inn Thank you very much for your reply. The examples you have given me is either WShttpBinding or netTcpBinding. But I cannot change my BasicHttpBinding . So please give me some example on basicHttpbinding .

Hemant Srivastava · Answer

If you disable the httGetEnabled property in your config and remove your metadata endpoint then no body could create the proxy. serviceMetadata httpGetEnabled =  false  />

tri_inn · Answer

i think you should go for custom authentication or you can use membership provider. just make the provision that when client will call your service then he/she has to supply userid and password. wcf service will check that user name & password against database. here i am giving u some link that may help u. http://social.msdn.microsoft.com/forums/en-US/wcf/thread/47ad5697-8789-423a-b304-4f73d5c7d6f6/ http://www.codeproject.com/Articles/458473/Custom-Authentication-and-Security-for-Routing-Ser http://msdn.microsoft.com/en-us/library/ff648360.aspx