WCF Security guidelines
I have been working on various WCF based service implementation and have a good working knowledge on security considerations. I have selective readings from MSDN and posting for myself to have a better understanding. (All the information below are excerpts from MSDN site) Design considerations different end points custom binding for legacy WSE Clients interoperability with non-Microsoft clients Consider Transport Security as your preferred security mode authentication/authorization options binding options (choose right binding) --- Auditing and logging WCF auditing to audit your service consider using SuppressAuditFailure to false (non-repudiation) use message logging only for debugging Instrument for user Management events Instrument for significant business operations Protect log files from unauthorized access do not log sensitive informaition Protect info in log files custom trace listener only when message filtering is needed ------ Authentication availab...