WCF Misconfiguration: Security Not Enabled

Abstract:

No transport or message security has been defined.

Explanation:

Applications that transmit messages without transport or message security cannot guarantee the integrity or confidentiality of the

messages. When a WCF security binding is set to None, both transport and message security are disabled.

The following configuration sets the security mode to None.

<system.serviceModel>

<bindings>

<wsHttpBinding>

<binding name="MyBinding">

<security mode="None"/>

</binding>

</bindings>

</system.serviceModel>

Recommendations:

Use transport and message security to protect the integrity and confidentiality of messages.

The configuration below tells the service to use transport security with message credentials.

<system.serviceModel>

<bindings>

<wsHttpBinding>

<binding name="MyBinding">

<security mode="TransportWithMessageCredential"/>

<message clientCredentialType="Windows"/>

</binding>

</bindings>

</system.serviceModel>