In WCF, when should we use TransportCredentialOnly security mode?

Question

I know TransportCredentialOnly security mode is not secure. The TransportCredentialOnly security mode option passes the user credentials without encrypting. It is really confusing me, when should we use this security mode in BasicHttpBinding ??

Answer 1

TransportCredentialOnly can be useful if the transport security is provided at a lower level than HTTPS (eg using IPSec) (ref: https://msdn.microsoft.com/en-gb/library/ff648505.aspx )

This might be the case if you're using a load balancer to provide HTTPS to the clients, but using HTTP between the load balancer and your backend servers. You could use TransportCredentialOnly on the service bindings and Transport on the client bindings.