Using transport and message security at the same time

WCF supports both transport- and message-layer security. By using transport-layer security, the SOAP message of our WCF service operation is completely unsecured, and the transport protocol (such as HTTPS, TCP) helps to secure the data transferred over them. By using message-layer security, the SOAP message itself is secured and the WCF runtime needs to perform the message-secure processing. Generally, we suggest that to developers that using either of the transport- or message-layer security is enough and this is also what the built-in system bindings allow us to do. However, it is still necessary to apply secure protection at both layers in some cases, especially when talking to some non-WCF service platforms. This recipe will use a simple HTTP-based WCF service to demonstrate how to apply secure protection at both transport and message layer.

How to do it...

Since built-in system bindings only support enabling security at one layer ...