Search code examples
web-servicessecuritywif

Securing a web service

We build web services that are for consumption by known third-parties.

We tend to implement very basic security that involves:

  • A known token ID which we communicate to both parties
  • Restrict access to known subset of IP addresses
  • Secure the transport layer via SSL

I'm not comfortable with this, but implementing Federated Security (using WIF/ADFS 2) is VERY complex! How can I justify using this tech - what is fundamentally wrong with the above approach?

I realise that the web service (which might expose sensitive data) is now only as secure as the token, but so would a username/password combo.

Thanks Duncan

Solution

  • To improve or replace the common token i would use some client/server certificate authentification. You will use SSL anyway and client certificate gives some more features