I use WCF only for data services (i.e. internal application and very bad, without session state, etc.) to maintain scalability of our web application.
We need to provide some common properties for every service call that we currently go through all the time. The presence of single request objects for each call is not ideal, because in addition to these common properties, the others will remain very diverse and change quite often during development.
I'm currently considering using custom headers and a clientmessageinspector to set values. Is this the easiest recommended approach for this scenario or is there a better approach?
Read more ..
The red dots below are where I’m not sure about the right approach (or how to do it).

What is sent
The transmitted data is a simple set of identifiers (3 or 4 for userid, clientid, etc.). All of these identifiers affect security and performance (in some cases, it determines which database to go to).
We will also expand this to have more complex permissions - not needed for working windows.
The caller will either be a web application in which they exit the session object, or a Windows service employee, where they are manually populated.
Modern thinking
Ideally, getinstance in the caller’s workflow will automatically populate these properties with a session object or more manually using Windows service calls (different constructors?).
Then we would guarantee that these parameters are always available without any thoughts or without permanent links in the entire code in order to build a contract for each function that calls it. We currently have a lot of service calls (due to the size / complexity of the application, and not due to poor engineering :)), since this applies to complex permissions, it becomes a little difficult to enforce the rules in a self-documenting way.
Conceptually, a session is where you take care of this in the application, but services are just a level of access to data (with display mapping, page browsing and last call checking from repository calls), so we don’t need the kind of repetition or complexity, Only key identifiers and permission fields to include in queries.
Problem
This is very similar to what we should do with the call headers, since we always need these fields, but I'm a little unsure where the set and get should sit on the life cycle of the endpoint and the client interface. I am also glad to make a mistake in this.