保护PHP客户端的WCF Web服务

Question

My WCF Web Service is written and hosted within my ASP.NET web application. This service will be consumed by the client written in php. How to securing this service? Which is the best pratice for?

Answer 1

PHP doesn't have native support for any advanced security features. Some of them can be added with some additional frameworks like WSO2 but then you can have a reverse problem because WSO2 offers its own subset of WS-Security and in this subset it offers popular UserName Token Profile with digested password which is in turn not provided in WCF (but can be added).

The simplest security for service exposed to PHP is HTTPS with Basic Authentication (IIS by default offers only Basic Authentication against Windows accounts but with custom HTTP module it will work with any credentials store).