security - Restricting WCF configuration in code -
We want to put WCF in the configuration file.
At the same time we want to reject a request code to send the data on the unencrypted net if the data will be sent. Something like this: If there is a request that without the hassle of bidding https, then remove the exception.
Is the service code aware of how it is being called?
Edit
The observations suggest that the question was not clear.
What I am trying to do is "fix" the following statement: We install a service with basicet binding and https, then the administrator changed it to not use https The effect is that the data is unencrypted on the net.
Are you self-hosting ?? The simplest approach would be:
servicehost servicehost = new service host (typef (service1), "http: // localhost: 1234 / myserv / xml"); Foreach (serviceEndpoint sep in serviceHost.Description.Endpoints) {if (sep.Binding.Scheme! = "Https") {// just delete that endpoint, or an error signal}}
Of course, when you host in IIS, it becomes a bit tricky ... you may have to create your own custom service host
line to check this , And make sure that your IIS based * .svc files use that custom host. Of course, a smart administrator might be able to use its own The custom host class can move using instead the base ServiceHost
is ......
Comments
Post a Comment