CODEWITHSUNDEEP
wcfsilverlightsecurity
James Newton-King
James Newton-King

Reputation: 49042

Securing a WCF service so that it can only be called by a Silverlight application

I am writing a Silverlight application that will be both reading and writing data to a serverside database via some WCF web services.

What is the best way to secure these web services?

My goal is to make sure the services can't be called by other applications and potentially spammed with requests to add items to the database. Only the Silverlight application needs to be able to access them.

Upvotes: 3

Views: 371

Answers (2)

Erik Mork
Erik Mork

Reputation: 1443

Don is absolutely right that there's no foolproof way of making sure that the client is a Silverlight application.

However, I think you're asking more about the following: Can I make sure that only people I trust connect to the service. The answer here is (basically) a yes, or at least we have standardized ways of doing this.

You're typically going to want to consider a couple of different approaches:

  • Transport level security. Has somebody tampered with the traffic? We use SSL for this.
  • Authentication. Am I talking to someone I trust? Here, we'll typically use one of the authentication mechanisms (Forms Auth, say). You can use Forms Authentication to secure both Silverlight (actually the page that Silverlight resides on) and the WCF services. Confusingly, SSL can be used (though rarely is because it's a pain in the neck) for authentication.

Upvotes: 8

Don Branson
Don Branson

Reputation: 13709

In general, you can't assume anything about the client. If you try to keep non-Silverlight apps from hitting your site, a malicious client can easily pretend to be a Silverlight app, and you're back to square one.

That is to say, this is not an effective way to secure a server. To secure your server, assume that any and all clients will hit your site, and start from there.

Edit:

Let me amend that to say that if you want to get into the world of mutual authentication, you can set up a PKI to manage certs, issue user certs for all your users, and then you know who your users are. Still, one of them might be malicious (and talented) and inject a cert into another client.

Upvotes: 4

Related Questions