以下配置在WCF的上下文中意味着什么？

Question

I added a WCF as a service reference to my client app from VS2013 and it generated the following config section in the app.config file.

                <security mode="Message">
                    <transport clientCredentialType="None" />
                    <message clientCredentialType="None" />
                </security>

What does this mean? The security mode is message but there are separate entities inside that for transport and message. I am confused.

Answer 1

You have two primary choices for providing transfer security: either you provide the transfer security on the transport level, or on the message level.

There is a nice article on MSDN discussing this here .

Transport Security:

When using transport security, the user credentials and claims are passed by using the transport layer. In other words, user credentials are transport-dependent, which allows fewer authentication options compared to message security.

Message Security:

When using message security, the user credentials and claims are encapsulated in every message using the WS-Security specification to secure messages. This option gives the most flexibility from an authentication perspective. You can use any type of security credentials you want, largely independent of transport, as long as both the client and service agree.

Update per comment

What it means in the context of the configuration file that you provided:

After setting a security mode (in this case message ), you have the option of setting the client credential type. The client credential type property specifies what type of credential the client must provide to the service for authentication. In this case, if either transport or message are specified as the security mode then they will use None as the client credential type which means that the client does not have to present any credential.

Currently, the following line is essentially being ignored as message is the specified security mode .

<transport clientCredentialType="None" />