在WCF中使用Windows身份验证类型时，是否以纯文本格式发送用户名和密码？

Question

If I have the following binding:

<bindings>
  <wsHttpBinding>
    <binding name="Binding">
      <security mode="Transport">
        <message clientCredentialType="Windows"/>
      </security>
    </binding>
  </wsHttpBinding>
</bindings>

Will the username and password be send on plain text over the wire?

Edit

I know that by default wcf encrypts the connection. The reason why I asked the question is because of:

I got that from http://msdn.microsoft.com/en-us/library/aa354513.aspx

So my question is I know that the connection is encrypted by default. But do I need a ssl certificate in order to prevent users from seeing the username and password. I know that once I am authenticated messages will be encrypted. But is the password and username encrypted too?

Answer 1

Other answers here are misleading and incorrect, although they may reassure you by mentioning transport security. The correct answer is that Windows Authentication does not send passwords in plain text.

Windows authentication works when the client guarantees to the server that the user is who they say they are. No password is transmitted over the wire.

If you were to use Basic Authentication then the password would be transmitted over the wire; if using any https transport then the connection is encrypted but within that connection the content of the message is not encrypted.

See How secure is WCF wsHttpBinding's Windows authentication? a similar question.

See MSDN Message and Transport Security for more about WCF transport security.

Answer 2

Data sent over the wire, contained in the message is in plain text; however, given that Transport security mode is being used, the client-server communication is being secured via ssl over http (and TLS in the case of TCP).

More can be read here about how Transport secures communication.

But because neither of the communicating parties are required to understand xml-level security concepts, the actual xml of a message is sent in plain text.

EDIT : Kirk Broadhurst is correct - in the case of Windows Authentication, username and password are not attached to/present on the message, but any data present is not encrypted.

Answer 3

WsHttpBinding encrypts messages by default so it will not be plain text.

More info here .