Basics Of WCF Security

This article is all about the basics of the WCF Security; in other words, this is the starting point of diving into the WCF Security concepts, and yes, security is the most important for any technology we are working. A decade before SOAP didn't provide a secure message from tampering rather there was a way to encrypt the messages; all the security details were delegated to the transport layer. As a result, making SOAP an independent platform was a big challenge. Then one fine day, a new generation of security, called WS-* specifications, was born to extend the existing SOAP specification with security capabilities for client authentication and message protection. The new model for securing the messages at the message levels were also included. This SOAP specification was created in combination with the big leaders in industries such as Microsoft, IBM and SUN, among others. The following are the principles that WCF uses to secure the communication over the network.

An authentication process normally asks the two questions, who are you and what is the proof you need to get inside? For these questions the sender must provide an answer to prove an identity in the form of username and password or Windows authentication or a token with cryptographic information or an X509 certificate. On the other hand, the service should have a mechanism for verifying/validating the evidence that was collected from the client. For example if the custom username and password is used, the service should have logic to validate the username and password supplied by the client. The client is successfully authenticated only if the verification drops good results. In the following three different scenarios the authentication would be fruitful:

Client Authentication is authentication by the service to validate and verify that you are the right person to utilize my service methods. Then what is server authentication? Server authentication is authenticated by the client to confirm that the client is talking to the right person, so the client needs to verify the service identity. Why does the client need to verify the server? Because we need to prevent phishing attacks that are nothing but an attacker who makes available a fake service with the same signature as the original one to capture sensitive information about the user, for example: credit card numbers, credit card pins and transaction passwords are normally not provided to anyone right? Until the person is your family member or a known good friend. The final one to discuss here is Mutual authentication, that is a combination of client authentication and the server authentication. The client and the server authenticate each other before any operation is made.

Authorization normally decides what are all the system resources or the operations can be accessed by an authenticated user. WCF provides a couple of mechanisms to Implement the authorizations in the services.

I am not going to explain in detail about the mechanisms in this article, we will discuss it in my series of articles on WCF Security.

It ensures that the contents of the message has not been tampered with or altered in transit. Say for examle the customer requests some amount from the bank, what if someone in the middle attacks the message by making some change in the values.