Geek Answers Handbook

WCF - Client Security with Web Control in CMS

Scenario:

We developed a wcf web service that communicates with the database inside our / dmz firewall. The web service and client application (web forms for collecting data) must be placed on our Internet server. This is because it needs to be accessed using the web controls that will be hosted on our third-party CMS (host our main website).

Question:

We want to ensure that the data can be transferred as securely as possible, but we will be careful about the exchange certificates between us and our CMS provider (and vice versa). We would rather have the web controls hosted as https, but all the documentation I read says authentication is required for certificates. I studied the application of additional user security between the client and svc (user bindings, username / password used in the code behind, call restriction by IP address), but I wanted to know if anyone else got this script.

We are sure that there should be examples of the use of user security when a third-party organization places web controls for an application, but so far I have just found on the Internet the comments "are these certificates or nothing." Any help or guidance was greatly appreciated.

An example of many of the links reviewed so far includes:

I was looking for an application of the suggested settings, for example. in <wshttpBinding> and <serviceCredentials> below, adding a new "Secure" class to contain a custom username / password validator, but "svc ... does not implement inherited elements ...".

 <wsHttpBinding> <binding name="EndpointBinding"> <security mode="TransportWithMessageCredential"> <transport clientCredentialType="None"/> <message clientCredentialType="UserName"/> </security> </binding> </wsHttpBinding> <serviceCredentials> <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="My.WcfSvc.Authentication.Secure, My.WcfSvc" /> </serviceCredentials>
+7
security c # wcf
source share
1 answer

I can best guess your architecture from what you wrote, but here are some thoughts on your implementation:

  • If you absolutely SHOULD use WCF to accomplish this, and this is done by server to server, I would do this through X-509 certificates. This gives you precise protection. I would also add some less important but supportive aspects for your IIS security implementation, such as IP address restrictions, null metadata implemented during production, etc. If you do not make this server on the server and do not use the web traffic that calls these methods, I will review your architecture and think about option No. 2.

  • If you still have time to do this in a different way, and I have the opportunity to change the other side of the development process, I prefer the token-based architecture for web interfaces transmitted over HTTPS with JSON. Not only can you identify the pre-shared tokens that you have provided to partners with IP / DNS restrictions around them, you can also perform a two-step authentication process before the data is processed. This gives you the opportunity to issue temporary tokens for data transfer, which expires quickly. In addition, you can also encrypt JSON using something like CryptoJS, which has up to 512 encryption using a pre-shared salt between you and your partner. https://code.google.com/archive/p/crypto-js/ - mostly unnecessary, but add something to your quiver. In general, two steps give you a much more reliable process of verification and peace of mind.

Hope this even helped. Good luck with your integration!

Edit: I realized that I was a little late for this party. Hope everything went well. What did you end up doing, OP?

+1
source share

More articles:


All Articles