Have Geek Brain

Do I need security between my ASP.net application and WCF service?

[I know this is quite subjective and depends on various considerations, so I just finish the ideas to understand what people think about this issue and what considerations they take ...]

We have an asp.net application open (requires username and password authentication), which in turn uses a set of WCF services in reverse order.

I am trying to decide what binding to use for these services, more specifically what security elements, if any, we should use.

all applications (web interface and all services) are on the same server farm behind a firewall, which blocks all access to services other than the web application. Under these conditions - would you say that it does not have any security features (and therefore has improved performance?)

For the sake of completeness, I would say that we expect to introduce some services at some point, but this will be done through a different endpoint with a different address, using highly secure elements including a federated id for authentication

0


a source to share


2 answers


Security is a wall. The more walls the better.

This is why we have secure database passwords that are internal but accessible from web applications, and why we encrypt sensitive data in those databases.



If security isn't going to be a big pain, add it.

+1


a source


You should also use your services to protect the username and password, for example with digest authentication, etc. The username and password that will be provided will be inside your application. Thus, you increase the level of security.



0


a source






More articles:


All Articles