Search code examples
c#wcfwcf-bindingwcf-security

Do i need a certificate for data transmission?


I want to secure transmission of data between my WCF client and service. I thought i would have to employ an ssl certificate.

Difference between BasicHttpBinding and WsHttpBinding

However - on this article the user explains the difference between basichttpbinding and wshttpbinding. Wshttpbinding as he shows it has the data encrypted without using certificates.

Am i missing something here?


Solution

  • No, you don't miss anything.

    Ssl provides security at the transport level. Which means that it uses https over http but messages are plain, old xmls.

    WsBinding is able to provide security at message level. Messages are passed even over http (not https!) but client and server exchange series of xmls which end up with exchanging keys and then the last message of the dialogue is an actual message but encrypted with previously constituted keys.

    In both cases, the general principle is the same but the security is constituted at just different levels.