Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have a Silverlight application that uses Entity Framework.

The application are protected with a login made in ASP, so only valid users get the xap file.

Have do I secure the WCF calls to the Entity Framework? I have to make the calls over https, but have can i make sure that only valid users can get data from the WCF service?

Thanks Jakob

share|improve this question

1 Answer 1

It's not easy. Ultimately, you're distributing the Silverlight application to users, and if those users want to examine its communications, they can do so.

If you do nothing to secure it, that's as simple as running a proxy such as Fiddler and just looking at what URLs it hits and what parameters it passes.

If you do take steps to secure it, bear in mind that since the users have the executable, they can reverse-engineer it. I've not disassembled a Silverlight app but I assume that like other .NET assemblies, it's not a particularly difficult process.

But if you want to put up a barrier to entry that will at least ensure that only people willing to make a genuine effort can reverse-engineer it, do something like this:

  • Public/private key pair; public key is in the app, private key on your server
  • All WCF calls include a parameter which is the other parameters concatenated and then encrypted with the public key
  • Server verifies this parameter on all calls

If you want to take one more step to protect against replay attacks, add a timestamp parameter to all service calls. This timestamp (which is concatenated along with the other parameters before encrypting) is also checked; allow some leeway for clocks being out of sync, but if it's more than a few minutes different to the server clock, reject the call.

But before spending too much time doing all this, once again, don't expect it to be foolproof.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.