What is the best way to secure a WCF service?

Question

What is the best way to secure a WCF service? Should I add a header to service calls and have a message inspector on the client that verifies the header?

I need to make sure that the person provides the correct user name and password to use the service and that everything is encrypted. It is over the internet and will be using HTTP binding.

Answer 1

That depends on what you mean by "secure". You can start with SSL (https), and progress to authentication techniques if you want to authenticate clients. You really need to elaborate on your goals...

Answer 2

You should take a look at this MSDN article, which sums up the options.

Much like a typical web application, you have several ways to secure the site:

1. Transport security (SSL)
2. Message security (message security header)
3. Transport with message credentials (combined)

The answer depends on what level of security you need to use for your application. In many cases, transport security may suffice.