Securing a dynamic SoapHeader
As described in the Adding a dynamic SoapHeader into a message recipe in Chapter 5, WCF supports dynamically adding SoapHeaders into request/response messages without defining them statically in ServiceContract or OperationContract. This works fine for those scenarios where the dynamic SoapHeader doesn't need to be secured (either signing or encrypting), since the programmatically-injected SoapHeader is transferred as unsecured in the <headers> section of a SOAP envelope. Then, how do we secure the dynamically added SoapHeader?
In this recipe, we will demonstrate how to secure a SoapHeader that is added into the WCF request message, programmatically.
How to do it...
To secure a dynamically added SoapHeader, we need to hook into the underlying security binding configuration of the WCF service endpoint. WCF provides a ChannelProtectionRequirements type, which contains the message security definition (such as the digital signature and encryption) on a different...
