How to implement secure communication between client and server in WCF?

Question

Here are my questions:

1. By default, is the communication between client and server (protocol: TCP) in WCF encrypted?

2. I need to implement a model, where only an authorized set of clients can use a WCF server. I thought of something along passing an AUTH structure as a param inside each method call. Is this the best method to implement this kind of security, or is there an easier/better way of doing this?

Answer 1

1) No

2) No, that is definitely not the "best" way. It is an easy way, but not a very flexible way, and not the way Microsoft recommends. There are a lot of different ways to secure WCF services, so I cannot write an exhaustive answer, but I suggest that you read up on it yourself. Check this article .