use wsHttpBinding or basicHttpBinding for silverlight app, which one?

Question

i want developing a wcf service which hosted on iis server and consume with a silverlight application on the web (SL app use from this wcf service). also i want use username-password authentication and authorization for my users who requesting from silverlight app.

i want Know i must use wsHttpBinding or basicHttpBinding for this purpose? i could not use wsHttpBinding at silverlight and when using basicHttpBinding, i could not create authentication and authorization for this binding

also i work with .net4 (wcf 4 and silverlight 4)

please help me thanks for your answers

Answer 1

I may be way off here, but I've just started a similar project. My first notion would be to use the basicHttpBinding. Your web service would then accept a username and password as parameters for any method call (username/password could be stored in a session or settings file). On the back end you would check the user's credentials on a per-call basis. Using this method would mean you would want to employ Https thus requiring you set the binding property

<security mode="Transport">

Hope this helps!

Answer 2

BasicHttpBinding does not support message-level security for authentication. It is possible to implement transport-level authentication, but this will require you to rely upon Windows authentication, and is therefore probably not cross-platform

Check here for more info -> http://msdn.microsoft.com/en-us/library/dd744835(v=vs.95).aspx

I would personally recommend you consider investigating REST style WCF services accessed via the Silverlight BrowserHttp stack... therefore if the user has authenticated to your server app via ASP.NET (I am assuming that your Silverlight app is hosted in ASP.NET/IIS) the Silverlight client app will use the same authentication credentials (by passing the same ASP.NET authentication cookie with its requests). This has worked better for me (and is less fiddly) than attempting to wrestle with BasicHttpBinding . This approach does mean that you forgo the use of 'Add Service Reference...' however. I recommend this blog post for more information on this approach.