Data Contracts used by a WCF service can change over time. To prevent anything from breaking we need some kind of data contract versioning. If strict schema validation is not necessary, we can implement the IExtensibleDataObject (IEDO) interface on our data contract to provide forward compatibility. More…
WCF Reliable Sessions, as defined by the WS-ReliableMessaging protocol, assures that SOAP messages don’t get lost, duplicated and/or re-ordered. It also prevents transport level errors (e.g. dropped connection). The reliability is at the SOAP message level, not at the transport level like TCP. More…
If you need much more reliable and durable messaging in WCF, Microsoft Message Queuing (MSMQ) comes into play. A message queue is a place where persistent messages are stored waiting to be delivered. A client or service can be down or busy but that doesn’t affect the other party. More…
In the previous example we did an impersonation of a windows user on a service operation. With the PrincipalPermission attribute we can also provide role based security. To test this on the WriteToLogFile operation of the EchoService, we create a local group named EchoLogWriters. More…
The previous example showed how to configure message based security with Windows authentication. So we know who the user is calling our service operations. But what can the user do on our system? On windows systems we can use user impersonation for authorization. More…
In a previous example I configured the EchoService to use transport security for BasicHttpBinding. Only the transport pipe is secured in this case. If point-to-point security isn’t secure enough, we can use end-to-end message based security. More…
If you create a BasicHttpBinding endpoint in WCF, by default neither messages or transportation is secure. Anyone snooping on the wire can read along. An easy way to secure communication over HTTP is by using Secure Sockets Layer (SSL). More…
It took me some time to figure this out. For a secure message transport we need a Secure Sockets Layer (SSL) Certificate from a Trusted Root Certification Authority like Symantec VeriSign. For development and testing purposes of WCF services you can be your own Certification Authority and issue a valid local certificate yourself. More…