Writing a WCF Web Service With Potential Future iPhone and Android Clients

Question

We're currently in the midst of rewriting our flagship product, and we've reached the point where we have to consider our options for remote and mobile access to our product. In general, our product is purchased and self-hosted by our customers. The current state of things uses a WCF service over NetTcpBinding to handle the interaction with our desktop application, and this is working fine. However, this obviously isn't a suitable option for our web and mobile clients.

Being more experienced with Windows desktop application development, I am a little out of my depth when it comes to choosing a web service technology and strategy, especially when having to consider compatibility with other platforms. What WCF web service technology would you recommend given the following requirements?

• Username/password-based authentication
• Session (stateful) behavior (though handling all of the session information locally and making the service stateless is an option)
• Ability to call the same service from an ASP.NET MVC web application, iPhone/iPad application, and Android application (and perhaps tertiary platforms like WP7 later)

I know that I could just implement a REST-ful service and roll my own solutions for session management and authentication, but I'd prefer to stick to industry conventions if at all possible. Is there a WCF technology (or set of technologies) that deal with these issues in a way that is compatible with the three platforms I've listed?

Answer 1

REST just uses HTTP protocol so every device acting as HTTP client is able to use it. It is not a protocol - you are defining protocol used over REST. Every mobile platform is able to consume REST services so you should not reach any blocking problem here and if you are not sure simply try to make some proof of concept.

Use WCF and check new Web-API (it is still only preview but it will be future version of WCF) because it simplifies REST service development with WCF and adds new features. For authentication you can use anything available in HTTP - basic authentication with HTTPS will work or you can check OAuth.

I have one big problem with your requirements:

Session (stateful) behavior (though handling all of the session information locally and making the service stateless is an option)

REST states for Representational state transfer. By nature all state should be transferred within request because you are posting new resources, getting existing resources and putting them back. By putting or posting resource you are making state transition defined in resource. Fully stateful communication is for RPC. But it is really hard to think about this more without deep knowledge of your product.

Answer 2

REST in Windows Communication Foundation (WCF)