Click here to Skip to main content
15,884,298 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I have a WCF Service with wsHTTPBinding using default message security. I am sending a token from client by adding it to soap header

using (ChannelFactory<mychannel> factory = new ChannelFactory<mychannel>(new WSHttpBinding()))
{
using (MyChannelproxy = factory.CreateChannel(new EndpointAddress(@"address")))
{
using (OperationContextScope scope = new OperationContextScope(proxy))
{
Guid myToken = Guid.NewGuid();

MessageHeader name = MessageHeader.CreateHeader("Name", "ns", myToken);
MessageHeader id = MessageHeader.CreateHeader("Id", "http://Vid", "Id");
OperationContext.Current.OutgoingMessageHeaders.Add(name);
OperationContext.Current.OutgoingMessageHeaders.Add(id);


1. When I saw the request going out using fiddler, its going as plain text, should I need to use Transport Security for soap header encryption ? Is there any other built in way to encrpt the information passing in soap header without using SSL

2. Is this the right way to add sensitive information in soap header ?

Please pass on some example or links you know that suits the situation, Thanks in advance
Posted

1 solution

 
Share this answer
 
Comments
sam3440 24-Oct-13 15:29pm    
Hi Ranjan, Is there any way we can achieve this without certificates ? coz, we deploy our service to all our customer and we don't want to force customer to install certificate (It's their choice)
Ranjan.D 24-Oct-13 16:48pm    
You could do some custom header encryptions. Have a look into - http://forums.asp.net/t/1787025.aspx?implementing+AES+256+encryption+for+a+WCF+service+with+a+timestamp+value

Yes it's not a good idea to include sensitive information in soap header
sam3440 24-Oct-13 17:21pm    
Could you please suggest what would be the best way to send the sensitive information please.
Ranjan.D 24-Oct-13 17:34pm    
I was just having a look into some thing for you.. and here I got one..

http://dotnetmentors.com/wcf/wcf-message-level-security-by-example.aspx

You are lucky messages can be secured very easily :) I think you can do something like below
<bindings>
<wshttpbinding>
<binding name="wsMessage">
<security mode="Message">
<message clientcredentialtype="None"></message>
</security>
</binding>
</wshttpbinding>
</bindings>

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900