Patterns and Practices: WCF Security Guidance available online

The Microsoft Patterns and Practices team has created a guide for WCF security. You can find more information at the root site


Reliable Messaging and SecurityToken validation

One of the things that have come up many times is how the service could stop a client from retrying a request for a valid security validation error while Reliable Messaging is enabled. If you are not familiar with the situation the essence of the problem is this, Binding on the Service has Reliable Messaging…


Security element and "actor" attribute.

SOAP 1.1 defines the attribute “actor” that can be on any SOAP header which will indicate who the ultimate processor of the header is going to be. It also defines a standard URI value for this actor attribute that is “” which implies that the header is intended for the very first SOAP application that…


Daylight savings changes and WCF Security Processing

I had a question today from a customer who was concerned that his WCF application might start to behave erratically due to the new Daylight savings schedule. Then I realized that there has been quite some noise around this area and people are predicting systems to stop responding when the new Daylight savings goes into…


WS-Federation Passive

I have discussed about Federation before. This post discusses Federation from the active context. “Active” means that the client is a smart client capable of doing encryption and signing and can actively participate in the Federation protocol. There are cases where the client is simply a Web Browser that is not capable of creating a secure…


Asymmetric tokens and Mixed-Mode Security

When you are using a X.509 Certificate as the client authentication token in Mixed-Mode Security – apart from signing the Timestamp WCF will sign the ‘To’ header as well. This is to prevent a client spoofing attack by a rougue service. Consider the situation where the client does not sign the ‘To’ header and sends the…


WCF Security Modes

WCF supports three types of Security. They are, Transport Security Mixed-Mode Security Message Security Let’s discuss the various Security Modes below.  Transport Security is applied at the transport byte stream below the message layer. The message does not have a Security header and the message does not carry any user authentication data. It is the…


Security Header Layout

There are four different security header layout that can be specified in WCF. The values are defined in WS-SecurityPolicy. They are, Strict – All security tokens are defined in the security header before its first use. The primary signature should be specified before any endorsing signatures. Lax – All elements inside the security header can…


Federation and Bearer Tokens

The latest WS-Trust spec (yet to be ratified by OASIS) introduces a concept called Bearer Tokens. This basically is a keyless token that a client requests from an STS (Security Token Service). The only purpose this token serves is to provide more information about the client to the service while the client already has a…


Re-Serialize SAML token

  In a Federation Scenario a client might want to access the services by using a SAML token that was issued to it by a STS. The service in turn might have to call other services (like a intermediary) to fulfill the request. When calling the backend service the service might want to use the…