Use wsHttpBinding or basicHttpBinding for a silverlight application, which one?

Question

I want to create a wcf service that is hosted on an iis server and consume it using the silverlight application on the Internet (using the SL application from this wcf service). I also want to use authentication and authorization of the username and password for my users who request the Silverlight application.

I want to Know that I should use wsHttpBinding or basicHttpBinding for this purpose? I could not use wsHttpBinding in silverlight and when using basicHttpBinding I could not create authentication and authorization for this binding

I also work with .net4 (wcf 4 and silverlight 4)

please help me thanks for your answers

Answer 1

I can be here, but I just started a similar project. My first concept would be to use basicHttpBinding. Then your web service will accept the username and password as parameters for any method call (the username / password can be saved in the session or settings file). On the back, you must check the user credentials for each call. Using this method would mean that you would like to use Https, requiring you to set the binding property

<security mode="Transport"> 

Hope this helps!

Answer 2

BasicHttpBinding does not support message-level security for authentication. You can implement authentication at the transport level, but this requires that you rely on Windows authentication and therefore are probably not cross-platform

Read more here → http://msdn.microsoft.com/en-us/library/dd744835(v=vs.95).aspx

I personally recommend that you consider looking for REST-style WCF services available through the Silverlight BrowserHttp stack ... so if a user authenticates your server application through ASP.NET (I assume your Silverlight application is hosted in ASP.NET / IIS) client Silverlight will use the same credentials for authentication (by passing the same ASP.NET authentication cookie with its requests). This has improved for me (and less difficult) than trying to deal with BasicHttpBinding . This approach means that you are refusing to use the "Add service link ...". I recommend this blog post for more information on this approach.